#pragma once
#ifndef _WIN64
typedef enum _SYSTEM_INFORMATION_CLASS {
    SystemBasicInformation,
    SystemProcessorInformation,             // obsolete...delete
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemPathInformation,
    SystemProcessInformation,  //ϵͳ������Ϣ
    SystemCallCountInformation,
    SystemDeviceInformation,
    SystemProcessorPerformanceInformation,
    SystemFlagsInformation,
    SystemCallTimeInformation,
    SystemModuleInformation,  //ϵͳģ����Ϣ
    SystemLocksInformation,
    SystemStackTraceInformation,
    SystemPagedPoolInformation,
    SystemNonPagedPoolInformation,
    SystemHandleInformation,  //ϵͳ�����Ϣ
    SystemObjectInformation,  //ϵͳ������Ϣ
    SystemPageFileInformation,
    SystemVdmInstemulInformation,
    SystemVdmBopInformation,
    SystemFileCacheInformation,
    SystemPoolTagInformation,
    SystemInterruptInformation,
    SystemDpcBehaviorInformation,
    SystemFullMemoryInformation,
    SystemLoadGdiDriverInformation,
    SystemUnloadGdiDriverInformation,
    SystemTimeAdjustmentInformation,
    SystemSummaryMemoryInformation,
    SystemMirrorMemoryInformation,
    SystemPerformanceTraceInformation,
    SystemObsolete0,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemExtendServiceTableInformation,
    SystemPrioritySeperation,
    SystemVerifierAddDriverInformation,
    SystemVerifierRemoveDriverInformation,
    SystemProcessorIdleInformation,
    SystemLegacyDriverInformation,
    SystemCurrentTimeZoneInformation,
    SystemLookasideInformation,
    SystemTimeSlipNotification,
    SystemSessionCreate,
    SystemSessionDetach,
    SystemSessionInformation,
    SystemRangeStartInformation,
    SystemVerifierInformation,
    SystemVerifierThunkExtend,
    SystemSessionProcessInformation,
    SystemLoadGdiDriverInSystemSpace,
    SystemNumaProcessorMap,
    SystemPrefetcherInformation,
    SystemExtendedProcessInformation,
    SystemRecommendedSharedDataAlignment,
    SystemComPlusPackage,
    SystemNumaAvailableMemory,
    SystemProcessorPowerInformation,
    SystemEmulationBasicInformation,
    SystemEmulationProcessorInformation,
    SystemExtendedHandleInformation,
    SystemLostDelayedWriteInformation,
    SystemBigPoolInformation,
    SystemSessionPoolTagInformation,
    SystemSessionMappedViewInformation,
    SystemHotpatchInformation,
    SystemObjectSecurityMode,
    SystemWatchdogTimerHandler,
    SystemWatchdogTimerInformation,
    SystemLogicalProcessorInformation,
    SystemWow64SharedInformation,
    SystemRegisterFirmwareTableInformationHandler,
    SystemFirmwareTableInformation,
    SystemModuleInformationEx,
    SystemVerifierTriageInformation,
    SystemSuperfetchInformation,
    SystemMemoryListInformation,
    SystemFileCacheInformationEx,
    MaxSystemInfoClass  // MaxSystemInfoClass should always be the last enum
} SYSTEM_INFORMATION_CLASS;



typedef struct _SYSTEM_THREADS
{
    LARGE_INTEGER           KernelTime;
    LARGE_INTEGER           UserTime;
    LARGE_INTEGER           CreateTime;
    ULONG                   WaitTime;
    PVOID                   StartAddress;
    CLIENT_ID               ClientIs;
    KPRIORITY               Priority;
    KPRIORITY               BasePriority;
    ULONG                   ContextSwitchCount;
    ULONG                   ThreadState;
    KWAIT_REASON            WaitReason;
}SYSTEM_THREADS, * PSYSTEM_THREADS;

//������Ϣ�ṹ��  
typedef struct _SYSTEM_PROCESSES
{
    ULONG                           NextEntryDelta;    //������һ���ṹ����һ���ṹ��ƫ��
    ULONG                           ThreadCount;
    ULONG                           Reserved[6];
    LARGE_INTEGER                   CreateTime;
    LARGE_INTEGER                   UserTime;
    LARGE_INTEGER                   KernelTime;
    UNICODE_STRING                  ProcessName;     //��������
    KPRIORITY                       BasePriority;
    ULONG                           ProcessId;      //���̵�pid��
    ULONG                           InheritedFromProcessId;
    ULONG                           HandleCount;
    ULONG                           Reserved2[2];
    VM_COUNTERS                     VmCounters;
    IO_COUNTERS                     IoCounters; //windows 2000 only  
    struct _SYSTEM_THREADS          Threads[1];
}SYSTEM_PROCESSES, * PSYSTEM_PROCESSES;

typedef struct _SYSTEM_MODULE_ENTRY
{
    HANDLE Section;
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    UCHAR FullPathName[256];
} SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY;



typedef struct _SYSTEM_MODULE_INFORMATION
{
    ULONG Count;
    SYSTEM_MODULE_ENTRY Module[0];
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;

struct _MMSUPPORT_FLAGS
{
    ULONG SessionSpace : 1;                                                   //0x0
    ULONG BeingTrimmed : 1;                                                   //0x0
    ULONG SessionLeader : 1;                                                  //0x0
    ULONG TrimHard : 1;                                                       //0x0
    ULONG WorkingSetHard : 1;                                                 //0x0
    ULONG AddressSpaceBeingDeleted : 1;                                       //0x0
    ULONG Available : 10;                                                     //0x0
    ULONG AllowWorkingSetAdjustment : 8;                                      //0x0
    ULONG MemoryPriority : 8;                                                 //0x0
};

struct _MMSUPPORT
{
    union _LARGE_INTEGER LastTrimTime;                                      //0x0
    struct _MMSUPPORT_FLAGS Flags;                                          //0x8
    ULONG PageFaultCount;                                                   //0xc
    ULONG PeakWorkingSetSize;                                               //0x10
    ULONG WorkingSetSize;                                                   //0x14
    ULONG MinimumWorkingSetSize;                                            //0x18
    ULONG MaximumWorkingSetSize;                                            //0x1c
    struct _MMWSL* VmWorkingSetList;                                        //0x20
    struct _LIST_ENTRY WorkingSetExpansionLinks;                            //0x24
    ULONG Claim;                                                            //0x2c
    ULONG NextEstimationSlot;                                               //0x30
    ULONG NextAgingSlot;                                                    //0x34
    ULONG EstimatedAvailable;                                               //0x38
    ULONG GrowthSinceLastEstimate;                                          //0x3c
};


//0x1 bytes (sizeof)
struct _KEXECUTE_OPTIONS
{
    UCHAR ExecuteDisable : 1;                                                 //0x0
    UCHAR ExecuteEnable : 1;                                                  //0x0
    UCHAR DisableThunkEmulation : 1;                                          //0x0
    UCHAR Permanent : 1;                                                      //0x0
    UCHAR ExecuteDispatchEnable : 1;                                          //0x0
    UCHAR ImageDispatchEnable : 1;                                            //0x0
    UCHAR Spare : 2;                                                          //0x0
};
struct _KIDTENTRY
{
    USHORT Offset;                                                          //0x0
    USHORT Selector;                                                        //0x2
    USHORT Access;                                                          //0x4
    USHORT ExtendedOffset;                                                  //0x6
};

struct _KGDTENTRY
{
    USHORT LimitLow;                                                        //0x0
    USHORT BaseLow;                                                         //0x2
    union
    {
        struct
        {
            UCHAR BaseMid;                                                  //0x4
            UCHAR Flags1;                                                   //0x5
            UCHAR Flags2;                                                   //0x6
            UCHAR BaseHi;                                                   //0x7
        } Bytes;                                                            //0x4
        struct
        {
            ULONG BaseMid : 8;                                                //0x4
            ULONG Type : 5;                                                   //0x4
            ULONG Dpl : 2;                                                    //0x4
            ULONG Pres : 1;                                                   //0x4
            ULONG LimitHi : 4;                                                //0x4
            ULONG Sys : 1;                                                    //0x4
            ULONG Reserved_0 : 1;                                             //0x4
            ULONG Default_Big : 1;                                            //0x4
            ULONG Granularity : 1;                                            //0x4
            ULONG BaseHi : 8;                                                 //0x4
        } Bits;                                                             //0x4
    } HighWord;                                                             //0x4
};
struct _KPROCESS
{
    struct _DISPATCHER_HEADER Header;                                       //0x0
    struct _LIST_ENTRY ProfileListHead;                                     //0x10
    ULONG DirectoryTableBase[2];                                            //0x18
    struct _KGDTENTRY LdtDescriptor;                                        //0x20
    struct _KIDTENTRY Int21Descriptor;                                      //0x28
    USHORT IopmOffset;                                                      //0x30
    UCHAR Iopl;                                                             //0x32
    UCHAR Unused;                                                           //0x33
    ULONG ActiveProcessors;                                                 //0x34
    ULONG KernelTime;                                                       //0x38
    ULONG UserTime;                                                         //0x3c
    struct _LIST_ENTRY ReadyListHead;                                       //0x40
    struct _SINGLE_LIST_ENTRY SwapListEntry;                                //0x48
    VOID* VdmTrapcHandler;                                                  //0x4c
    struct _LIST_ENTRY ThreadListHead;                                      //0x50
    ULONG ProcessLock;                                                      //0x58
    ULONG Affinity;                                                         //0x5c
    USHORT StackCount;                                                      //0x60
    CHAR BasePriority;                                                      //0x62
    CHAR ThreadQuantum;                                                     //0x63
    UCHAR AutoAlignment;                                                    //0x64
    UCHAR State;                                                            //0x65
    UCHAR ThreadSeed;                                                       //0x66
    UCHAR DisableBoost;                                                     //0x67
    UCHAR PowerState;                                                       //0x68
    UCHAR DisableQuantum;                                                   //0x69
    UCHAR IdealNode;                                                        //0x6a
    union
    {
        struct _KEXECUTE_OPTIONS Flags;                                     //0x6b
        UCHAR ExecuteOptions;                                               //0x6b
    };
};
struct _EX_PUSH_LOCK
{
    union
    {
        struct
        {
            ULONG Waiting : 1;                                                //0x0
            ULONG Exclusive : 1;                                              //0x0
            ULONG Shared : 30;                                                //0x0
        };
        ULONG Value;                                                        //0x0
        VOID* Ptr;                                                          //0x0
    };
};
struct _EX_FAST_REF
{
    union
    {
        VOID* Object;                                                       //0x0
        ULONG RefCnt : 3;                                                     //0x0
        ULONG Value;                                                        //0x0
    };
};

struct _HARDWARE_PTE
{
    ULONG Valid : 1;                                                          //0x0
    ULONG Write : 1;                                                          //0x0
    ULONG Owner : 1;                                                          //0x0
    ULONG WriteThrough : 1;                                                   //0x0
    ULONG CacheDisable : 1;                                                   //0x0
    ULONG Accessed : 1;                                                       //0x0
    ULONG Dirty : 1;                                                          //0x0
    ULONG LargePage : 1;                                                      //0x0
    ULONG Global : 1;                                                         //0x0
    ULONG CopyOnWrite : 1;                                                    //0x0
    ULONG Prototype : 1;                                                      //0x0
    ULONG reserved : 1;                                                       //0x0
    ULONG PageFrameNumber : 20;                                               //0x0
};

struct _SE_AUDIT_PROCESS_CREATION_INFO
{
    struct _OBJECT_NAME_INFORMATION* ImageFileName;                         //0x0
};
typedef struct _EPROCESS
{
    struct _KPROCESS Pcb;                                                   //0x0
    struct _EX_PUSH_LOCK ProcessLock;                                       //0x6c
    union _LARGE_INTEGER CreateTime;                                        //0x70
    union _LARGE_INTEGER ExitTime;                                          //0x78
    struct _EX_RUNDOWN_REF RundownProtect;                                  //0x80
    VOID* UniqueProcessId;                                                  //0x84
    struct _LIST_ENTRY ActiveProcessLinks;                                  //0x88
    ULONG QuotaUsage[3];                                                    //0x90
    ULONG QuotaPeak[3];                                                     //0x9c
    ULONG CommitCharge;                                                     //0xa8
    ULONG PeakVirtualSize;                                                  //0xac
    ULONG VirtualSize;                                                      //0xb0
    struct _LIST_ENTRY SessionProcessLinks;                                 //0xb4
    VOID* DebugPort;                                                        //0xbc
    VOID* ExceptionPort;                                                    //0xc0
    struct _HANDLE_TABLE* ObjectTable;                                      //0xc4
    struct _EX_FAST_REF Token;                                              //0xc8
    struct _FAST_MUTEX WorkingSetLock;                                      //0xcc
    ULONG WorkingSetPage;                                                   //0xec
    struct _FAST_MUTEX AddressCreationLock;                                 //0xf0
    ULONG HyperSpaceLock;                                                   //0x110
    struct _ETHREAD* ForkInProgress;                                        //0x114
    ULONG HardwareTrigger;                                                  //0x118
    VOID* VadRoot;                                                          //0x11c
    VOID* VadHint;                                                          //0x120
    VOID* CloneRoot;                                                        //0x124
    ULONG NumberOfPrivatePages;                                             //0x128
    ULONG NumberOfLockedPages;                                              //0x12c
    VOID* Win32Process;                                                     //0x130
    struct _EJOB* Job;                                                      //0x134
    VOID* SectionObject;                                                    //0x138
    VOID* SectionBaseAddress;                                               //0x13c
    struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;                               //0x140
    struct _PAGEFAULT_HISTORY* WorkingSetWatch;                             //0x144
    VOID* Win32WindowStation;                                               //0x148
    VOID* InheritedFromUniqueProcessId;                                     //0x14c
    VOID* LdtInformation;                                                   //0x150
    VOID* VadFreeHint;                                                      //0x154
    VOID* VdmObjects;                                                       //0x158
    VOID* DeviceMap;                                                        //0x15c
    struct _LIST_ENTRY PhysicalVadList;                                     //0x160
    union
    {
        struct _HARDWARE_PTE PageDirectoryPte;                              //0x168
        ULONGLONG Filler;                                                   //0x168
    };
    VOID* Session;                                                          //0x170
    UCHAR ImageFileName[16];                                                //0x174
    struct _LIST_ENTRY JobLinks;                                            //0x184
    VOID* LockedPagesList;                                                  //0x18c
    struct _LIST_ENTRY ThreadListHead;                                      //0x190
    VOID* SecurityPort;                                                     //0x198
    VOID* PaeTop;                                                           //0x19c
    ULONG ActiveThreads;                                                    //0x1a0
    ULONG GrantedAccess;                                                    //0x1a4
    ULONG DefaultHardErrorProcessing;                                       //0x1a8
    LONG LastThreadExitStatus;                                              //0x1ac
    struct _PEB* Peb;                                                       //0x1b0
    struct _EX_FAST_REF PrefetchTrace;                                      //0x1b4
    union _LARGE_INTEGER ReadOperationCount;                                //0x1b8
    union _LARGE_INTEGER WriteOperationCount;                               //0x1c0
    union _LARGE_INTEGER OtherOperationCount;                               //0x1c8
    union _LARGE_INTEGER ReadTransferCount;                                 //0x1d0
    union _LARGE_INTEGER WriteTransferCount;                                //0x1d8
    union _LARGE_INTEGER OtherTransferCount;                                //0x1e0
    ULONG CommitChargeLimit;                                                //0x1e8
    ULONG CommitChargePeak;                                                 //0x1ec
    VOID* AweInfo;                                                          //0x1f0
    struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;      //0x1f4
    struct _MMSUPPORT Vm;                                                   //0x1f8
    ULONG LastFaultCount;                                                   //0x238
    ULONG ModifiedPageCount;                                                //0x23c
    ULONG NumberOfVads;                                                     //0x240
    ULONG JobStatus;                                                        //0x244
    union
    {
        ULONG Flags;                                                        //0x248
        struct
        {
            ULONG CreateReported : 1;                                         //0x248
            ULONG NoDebugInherit : 1;                                         //0x248
            ULONG ProcessExiting : 1;                                         //0x248
            ULONG ProcessDelete : 1;                                          //0x248
            ULONG Wow64SplitPages : 1;                                        //0x248
            ULONG VmDeleted : 1;                                              //0x248
            ULONG OutswapEnabled : 1;                                         //0x248
            ULONG Outswapped : 1;                                             //0x248
            ULONG ForkFailed : 1;                                             //0x248
            ULONG HasPhysicalVad : 1;                                         //0x248
            ULONG AddressSpaceInitialized : 2;                                //0x248
            ULONG SetTimerResolution : 1;                                     //0x248
            ULONG BreakOnTermination : 1;                                     //0x248
            ULONG SessionCreationUnderway : 1;                                //0x248
            ULONG WriteWatch : 1;                                             //0x248
            ULONG ProcessInSession : 1;                                       //0x248
            ULONG OverrideAddressSpace : 1;                                   //0x248
            ULONG HasAddressSpace : 1;                                        //0x248
            ULONG LaunchPrefetched : 1;                                       //0x248
            ULONG InjectInpageErrors : 1;                                     //0x248
            ULONG VmTopDown : 1;                                              //0x248
            ULONG Unused3 : 1;                                                //0x248
            ULONG Unused4 : 1;                                                //0x248
            ULONG VdmAllowed : 1;                                             //0x248
            ULONG Unused : 5;                                                 //0x248
            ULONG Unused1 : 1;                                                //0x248
            ULONG Unused2 : 1;                                                //0x248
        };
    };
    LONG ExitStatus;                                                        //0x24c
    USHORT NextPageColor;                                                   //0x250
    union
    {
        struct
        {
            UCHAR SubSystemMinorVersion;                                    //0x252
            UCHAR SubSystemMajorVersion;                                    //0x253
        };
        USHORT SubSystemVersion;                                            //0x252
    };
    UCHAR PriorityClass;                                                    //0x254
    UCHAR WorkingSetAcquiredUnsafe;                                         //0x255
    ULONG Cookie;                                                           //0x258
}EPROCESS_XP, * PEPROCESS_XP;


struct _KTHREAD
{
    struct _DISPATCHER_HEADER Header;                                       //0x0
    struct _LIST_ENTRY MutantListHead;                                      //0x10
    VOID* InitialStack;                                                     //0x18
    VOID* StackLimit;                                                       //0x1c
    VOID* Teb;                                                              //0x20
    VOID* TlsArray;                                                         //0x24
    VOID* KernelStack;                                                      //0x28
    UCHAR DebugActive;                                                      //0x2c
    UCHAR State;                                                            //0x2d
    UCHAR Alerted[2];                                                       //0x2e
    UCHAR Iopl;                                                             //0x30
    UCHAR NpxState;                                                         //0x31
    CHAR Saturation;                                                        //0x32
    CHAR Priority;                                                          //0x33
    struct _KAPC_STATE ApcState;                                            //0x34
    ULONG ContextSwitches;                                                  //0x4c
    UCHAR IdleSwapBlock;                                                    //0x50
    UCHAR Spare0[3];                                                        //0x51
    LONG WaitStatus;                                                        //0x54
    UCHAR WaitIrql;                                                         //0x58
    CHAR WaitMode;                                                          //0x59
    UCHAR WaitNext;                                                         //0x5a
    UCHAR WaitReason;                                                       //0x5b
    struct _KWAIT_BLOCK* WaitBlockList;                                     //0x5c
    union
    {
        struct _LIST_ENTRY WaitListEntry;                                   //0x60
        struct _SINGLE_LIST_ENTRY SwapListEntry;                            //0x60
    };
    ULONG WaitTime;                                                         //0x68
    CHAR BasePriority;                                                      //0x6c
    UCHAR DecrementCount;                                                   //0x6d
    CHAR PriorityDecrement;                                                 //0x6e
    CHAR Quantum;                                                           //0x6f
    struct _KWAIT_BLOCK WaitBlock[4];                                       //0x70
    VOID* LegoData;                                                         //0xd0
    ULONG KernelApcDisable;                                                 //0xd4
    ULONG UserAffinity;                                                     //0xd8
    UCHAR SystemAffinityActive;                                             //0xdc
    UCHAR PowerState;                                                       //0xdd
    UCHAR NpxIrql;                                                          //0xde
    UCHAR InitialNode;                                                      //0xdf
    VOID* ServiceTable;                                                     //0xe0
    struct _KQUEUE* Queue;                                                  //0xe4
    ULONG ApcQueueLock;                                                     //0xe8
    struct _KTIMER Timer;                                                   //0xf0
    struct _LIST_ENTRY QueueListEntry;                                      //0x118
    ULONG SoftAffinity;                                                     //0x120
    ULONG Affinity;                                                         //0x124
    UCHAR Preempted;                                                        //0x128
    UCHAR ProcessReadyQueue;                                                //0x129
    UCHAR KernelStackResident;                                              //0x12a
    UCHAR NextProcessor;                                                    //0x12b
    VOID* CallbackStack;                                                    //0x12c
    VOID* Win32Thread;                                                      //0x130
    struct _KTRAP_FRAME* TrapFrame;                                         //0x134
    struct _KAPC_STATE* ApcStatePointer[2];                                 //0x138
    CHAR PreviousMode;                                                      //0x140
    UCHAR EnableStackSwap;                                                  //0x141
    UCHAR LargeStack;                                                       //0x142
    UCHAR ResourceIndex;                                                    //0x143
    ULONG KernelTime;                                                       //0x144
    ULONG UserTime;                                                         //0x148
    struct _KAPC_STATE SavedApcState;                                       //0x14c
    UCHAR Alertable;                                                        //0x164
    UCHAR ApcStateIndex;                                                    //0x165
    UCHAR ApcQueueable;                                                     //0x166
    UCHAR AutoAlignment;                                                    //0x167
    VOID* StackBase;                                                        //0x168
    struct _KAPC SuspendApc;                                                //0x16c
    struct _KSEMAPHORE SuspendSemaphore;                                    //0x19c
    struct _LIST_ENTRY ThreadListEntry;                                     //0x1b0
    CHAR FreezeCount;                                                       //0x1b8
    CHAR SuspendCount;                                                      //0x1b9
    UCHAR IdealProcessor;                                                   //0x1ba
    UCHAR DisableBoost;                                                     //0x1bb
};

typedef struct _ETHREAD
{
    struct _KTHREAD Tcb;                                                    //0x0
    union
    {
        union _LARGE_INTEGER CreateTime;                                    //0x1c0
        struct
        {
            ULONG NestedFaultCount : 2;                                       //0x1c0
            ULONG ApcNeeded : 1;                                              //0x1c0
        };
    };
    union
    {
        union _LARGE_INTEGER ExitTime;                                      //0x1c8
        struct _LIST_ENTRY LpcReplyChain;                                   //0x1c8
        struct _LIST_ENTRY KeyedWaitChain;                                  //0x1c8
    };
    union
    {
        LONG ExitStatus;                                                    //0x1d0
        VOID* OfsChain;                                                     //0x1d0
    };
    struct _LIST_ENTRY PostBlockList;                                       //0x1d4
    union
    {
        struct _TERMINATION_PORT* TerminationPort;                          //0x1dc
        struct _ETHREAD* ReaperLink;                                        //0x1dc
        VOID* KeyedWaitValue;                                               //0x1dc
    };
    ULONG ActiveTimerListLock;                                              //0x1e0
    struct _LIST_ENTRY ActiveTimerListHead;                                 //0x1e4
    struct _CLIENT_ID Cid;                                                  //0x1ec
    union
    {
        struct _KSEMAPHORE LpcReplySemaphore;                               //0x1f4
        struct _KSEMAPHORE KeyedWaitSemaphore;                              //0x1f4
    };
    union
    {
        VOID* LpcReplyMessage;                                              //0x208
        VOID* LpcWaitingOnPort;                                             //0x208
    };
    struct _PS_IMPERSONATION_INFORMATION* ImpersonationInfo;                //0x20c
    struct _LIST_ENTRY IrpList;                                             //0x210
    ULONG TopLevelIrp;                                                      //0x218
    struct _DEVICE_OBJECT* DeviceToVerify;                                  //0x21c
    struct _EPROCESS* ThreadsProcess;                                       //0x220
    VOID* StartAddress;                                                     //0x224
    union
    {
        VOID* Win32StartAddress;                                            //0x228
        ULONG LpcReceivedMessageId;                                         //0x228
    };
    struct _LIST_ENTRY ThreadListEntry;                                     //0x22c
    struct _EX_RUNDOWN_REF RundownProtect;                                  //0x234
    struct _EX_PUSH_LOCK ThreadLock;                                        //0x238
    ULONG LpcReplyMessageId;                                                //0x23c
    ULONG ReadClusterSize;                                                  //0x240
    ULONG GrantedAccess;                                                    //0x244
    union
    {
        ULONG CrossThreadFlags;                                             //0x248
        struct
        {
            ULONG Terminated : 1;                                             //0x248
            ULONG DeadThread : 1;                                             //0x248
            ULONG HideFromDebugger : 1;                                       //0x248
            ULONG ActiveImpersonationInfo : 1;                                //0x248
            ULONG SystemThread : 1;                                           //0x248
            ULONG HardErrorsAreDisabled : 1;                                  //0x248
            ULONG BreakOnTermination : 1;                                     //0x248
            ULONG SkipCreationMsg : 1;                                        //0x248
            ULONG SkipTerminationMsg : 1;                                     //0x248
        };
    };
    union
    {
        ULONG SameThreadPassiveFlags;                                       //0x24c
        struct
        {
            ULONG ActiveExWorker : 1;                                         //0x24c
            ULONG ExWorkerCanWaitUser : 1;                                    //0x24c
            ULONG MemoryMaker : 1;                                            //0x24c
        };
    };
    union
    {
        ULONG SameThreadApcFlags;                                           //0x250
        struct
        {
            UCHAR LpcReceivedMsgIdValid : 1;                                  //0x250
            UCHAR LpcExitThreadCalled : 1;                                    //0x250
            UCHAR AddressSpaceOwner : 1;                                      //0x250
        };
    };
    UCHAR ForwardClusterOnly;                                               //0x254
    UCHAR DisablePageFaultClustering;                                       //0x255
}ETHREAD_XP,*PETHREAD_XP;



struct _PP_LOOKASIDE_LIST
{
    struct _GENERAL_LOOKASIDE* P;                                           //0x0
    struct _GENERAL_LOOKASIDE* L;                                           //0x4
};
typedef struct _FLOATING_SAVE_AREA_XP
{
    ULONG ControlWord;                                                      //0x0
    ULONG StatusWord;                                                       //0x4
    ULONG TagWord;                                                          //0x8
    ULONG ErrorOffset;                                                      //0xc
    ULONG ErrorSelector;                                                    //0x10
    ULONG DataOffset;                                                       //0x14
    ULONG DataSelector;                                                     //0x18
    UCHAR RegisterArea[80];                                                 //0x1c
    ULONG Cr0NpxState;                                                      //0x6c
} FLOATING_SAVE_AREA_XP, * PFLOATING_SAVE_AREA_XP;
typedef struct _CONTEXT_XP
{
    ULONG ContextFlags;                                                     //0x0
    ULONG Dr0;                                                              //0x4
    ULONG Dr1;                                                              //0x8
    ULONG Dr2;                                                              //0xc
    ULONG Dr3;                                                              //0x10
    ULONG Dr6;                                                              //0x14
    ULONG Dr7;                                                              //0x18
    FLOATING_SAVE_AREA_XP FloatSave;                                   //0x1c
    ULONG SegGs;                                                            //0x8c
    ULONG SegFs;                                                            //0x90
    ULONG SegEs;                                                            //0x94
    ULONG SegDs;                                                            //0x98
    ULONG Edi;                                                              //0x9c
    ULONG Esi;                                                              //0xa0
    ULONG Ebx;                                                              //0xa4
    ULONG Edx;                                                              //0xa8
    ULONG Ecx;                                                              //0xac
    ULONG Eax;                                                              //0xb0
    ULONG Ebp;                                                              //0xb4
    ULONG Eip;                                                              //0xb8
    ULONG SegCs;                                                            //0xbc
    ULONG EFlags;                                                           //0xc0
    ULONG Esp;                                                              //0xc4
    ULONG SegSs;                                                            //0xc8
    UCHAR ExtendedRegisters[512];                                           //0xcc
}CONTEXT_XP,*PCONTEXT_XP;
//0x8 bytes (sizeof)
struct _DESCRIPTOR
{
    USHORT Pad;                                                             //0x0
    USHORT Limit;                                                           //0x2
    ULONG Base;                                                             //0x4
};
struct _KSPECIAL_REGISTERS
{
    ULONG Cr0;                                                              //0x0
    ULONG Cr2;                                                              //0x4
    ULONG Cr3;                                                              //0x8
    ULONG Cr4;                                                              //0xc
    ULONG KernelDr0;                                                        //0x10
    ULONG KernelDr1;                                                        //0x14
    ULONG KernelDr2;                                                        //0x18
    ULONG KernelDr3;                                                        //0x1c
    ULONG KernelDr6;                                                        //0x20
    ULONG KernelDr7;                                                        //0x24
    struct _DESCRIPTOR Gdtr;                                                //0x28
    struct _DESCRIPTOR Idtr;                                                //0x30
    USHORT Tr;                                                              //0x38
    USHORT Ldtr;                                                            //0x3a
    ULONG Reserved[6];                                                      //0x3c
};
struct _KPROCESSOR_STATE
{
    CONTEXT_XP ContextFrame;                                           //0x0
    struct _KSPECIAL_REGISTERS SpecialRegisters;                            //0x2cc
};


struct _FNSAVE_FORMAT
{
    ULONG ControlWord;                                                      //0x0
    ULONG StatusWord;                                                       //0x4
    ULONG TagWord;                                                          //0x8
    ULONG ErrorOffset;                                                      //0xc
    ULONG ErrorSelector;                                                    //0x10
    ULONG DataOffset;                                                       //0x14
    ULONG DataSelector;                                                     //0x18
    UCHAR RegisterArea[80];                                                 //0x1c
};

struct _FXSAVE_FORMAT
{
    USHORT ControlWord;                                                     //0x0
    USHORT StatusWord;                                                      //0x2
    USHORT TagWord;                                                         //0x4
    USHORT ErrorOpcode;                                                     //0x6
    ULONG ErrorOffset;                                                      //0x8
    ULONG ErrorSelector;                                                    //0xc
    ULONG DataOffset;                                                       //0x10
    ULONG DataSelector;                                                     //0x14
    ULONG MXCsr;                                                            //0x18
    ULONG MXCsrMask;                                                        //0x1c
    UCHAR RegisterArea[128];                                                //0x20
    UCHAR Reserved3[128];                                                   //0xa0
    UCHAR Reserved4[224];                                                   //0x120
    UCHAR Align16Byte[8];                                                   //0x200
};
//0x210 bytes (sizeof)
struct _FX_SAVE_AREA
{
    union
    {
        struct _FNSAVE_FORMAT FnArea;                                       //0x0
        struct _FXSAVE_FORMAT FxArea;                                       //0x0
    } U;                                                                    //0x0
    ULONG NpxSavedCpu;                                                      //0x208
    ULONG Cr0NpxState;                                                      //0x20c
};
struct PROCESSOR_IDLE_TIMES
{
    ULONGLONG StartTime;                                                    //0x0
    ULONGLONG EndTime;                                                      //0x8
    ULONG IdleHandlerReserved[4];                                           //0x10
};

struct _PROCESSOR_POWER_STATE
{
    VOID(*IdleFunction)(struct _PROCESSOR_POWER_STATE* arg1);              //0x0
    ULONG Idle0KernelTimeLimit;                                             //0x4
    ULONG Idle0LastTime;                                                    //0x8
    VOID* IdleHandlers;                                                     //0xc
    VOID* IdleState;                                                        //0x10
    ULONG IdleHandlersCount;                                                //0x14
    ULONGLONG LastCheck;                                                    //0x18
    struct PROCESSOR_IDLE_TIMES IdleTimes;                                  //0x20
    ULONG IdleTime1;                                                        //0x40
    ULONG PromotionCheck;                                                   //0x44
    ULONG IdleTime2;                                                        //0x48
    UCHAR CurrentThrottle;                                                  //0x4c
    UCHAR ThermalThrottleLimit;                                             //0x4d
    UCHAR CurrentThrottleIndex;                                             //0x4e
    UCHAR ThermalThrottleIndex;                                             //0x4f
    ULONG LastKernelUserTime;                                               //0x50
    ULONG LastIdleThreadKernelTime;                                         //0x54
    ULONG PackageIdleStartTime;                                             //0x58
    ULONG PackageIdleTime;                                                  //0x5c
    ULONG DebugCount;                                                       //0x60
    ULONG LastSysTime;                                                      //0x64
    ULONGLONG TotalIdleStateTime[3];                                        //0x68
    ULONG TotalIdleTransitions[3];                                          //0x80
    ULONGLONG PreviousC3StateTime;                                          //0x90
    UCHAR KneeThrottleIndex;                                                //0x98
    UCHAR ThrottleLimitIndex;                                               //0x99
    UCHAR PerfStatesCount;                                                  //0x9a
    UCHAR ProcessorMinThrottle;                                             //0x9b
    UCHAR ProcessorMaxThrottle;                                             //0x9c
    UCHAR EnableIdleAccounting;                                             //0x9d
    UCHAR LastC3Percentage;                                                 //0x9e
    UCHAR LastAdjustedBusyPercentage;                                       //0x9f
    ULONG PromotionCount;                                                   //0xa0
    ULONG DemotionCount;                                                    //0xa4
    ULONG ErrorCount;                                                       //0xa8
    ULONG RetryCount;                                                       //0xac
    ULONG Flags;                                                            //0xb0
    union _LARGE_INTEGER PerfCounterFrequency;                              //0xb8
    ULONG PerfTickCount;                                                    //0xc0
    struct _KTIMER PerfTimer;                                               //0xc8
    struct _KDPC PerfDpc;                                                   //0xf0
    struct PROCESSOR_PERF_STATE* PerfStates;                                //0x110
    LONG(*PerfSetThrottle)(UCHAR arg1);                                    //0x114
    ULONG LastC3KernelUserTime;                                             //0x118
    ULONG LastPackageIdleTime;                                              //0x11c
};


struct _KPRCB
{
    USHORT MinorVersion;                                                    //0x0
    USHORT MajorVersion;                                                    //0x2
    struct _KTHREAD* CurrentThread;                                         //0x4
    struct _KTHREAD* NextThread;                                            //0x8
    struct _KTHREAD* IdleThread;                                            //0xc
    CHAR Number;                                                            //0x10
    CHAR Reserved;                                                          //0x11
    USHORT BuildType;                                                       //0x12
    ULONG SetMember;                                                        //0x14
    CHAR CpuType;                                                           //0x18
    CHAR CpuID;                                                             //0x19
    USHORT CpuStep;                                                         //0x1a
    struct _KPROCESSOR_STATE ProcessorState;                                //0x1c
    ULONG KernelReserved[16];                                               //0x33c
    ULONG HalReserved[16];                                                  //0x37c
    UCHAR PrcbPad0[92];                                                     //0x3bc
    struct _KSPIN_LOCK_QUEUE LockQueue[16];                                 //0x418
    UCHAR PrcbPad1[8];                                                      //0x498
    struct _KTHREAD* NpxThread;                                             //0x4a0
    ULONG InterruptCount;                                                   //0x4a4
    ULONG KernelTime;                                                       //0x4a8
    ULONG UserTime;                                                         //0x4ac
    ULONG DpcTime;                                                          //0x4b0
    ULONG DebugDpcTime;                                                     //0x4b4
    ULONG InterruptTime;                                                    //0x4b8
    ULONG AdjustDpcThreshold;                                               //0x4bc
    ULONG PageColor;                                                        //0x4c0
    ULONG SkipTick;                                                         //0x4c4
    UCHAR MultiThreadSetBusy;                                               //0x4c8
    UCHAR Spare2[3];                                                        //0x4c9
    struct _KNODE* ParentNode;                                              //0x4cc
    ULONG MultiThreadProcessorSet;                                          //0x4d0
    struct _KPRCB* MultiThreadSetMaster;                                    //0x4d4
    ULONG ThreadStartCount[2];                                              //0x4d8
    ULONG CcFastReadNoWait;                                                 //0x4e0
    ULONG CcFastReadWait;                                                   //0x4e4
    ULONG CcFastReadNotPossible;                                            //0x4e8
    ULONG CcCopyReadNoWait;                                                 //0x4ec
    ULONG CcCopyReadWait;                                                   //0x4f0
    ULONG CcCopyReadNoWaitMiss;                                             //0x4f4
    ULONG KeAlignmentFixupCount;                                            //0x4f8
    ULONG KeContextSwitches;                                                //0x4fc
    ULONG KeDcacheFlushCount;                                               //0x500
    ULONG KeExceptionDispatchCount;                                         //0x504
    ULONG KeFirstLevelTbFills;                                              //0x508
    ULONG KeFloatingEmulationCount;                                         //0x50c
    ULONG KeIcacheFlushCount;                                               //0x510
    ULONG KeSecondLevelTbFills;                                             //0x514
    ULONG KeSystemCalls;                                                    //0x518
    ULONG SpareCounter0[1];                                                 //0x51c
    struct _PP_LOOKASIDE_LIST PPLookasideList[16];                          //0x520
    struct _PP_LOOKASIDE_LIST PPNPagedLookasideList[32];                    //0x5a0
    struct _PP_LOOKASIDE_LIST PPPagedLookasideList[32];                     //0x6a0
    volatile ULONG PacketBarrier;                                           //0x7a0
    volatile ULONG ReverseStall;                                            //0x7a4
    VOID* IpiFrame;                                                         //0x7a8
    UCHAR PrcbPad2[52];                                                     //0x7ac
    VOID* volatile CurrentPacket[3];                                        //0x7e0
    volatile ULONG TargetSet;                                               //0x7ec
    VOID(*volatileWorkerRoutine)(VOID* arg1, VOID* arg2, VOID* arg3, VOID* arg4); //0x7f0
    volatile ULONG IpiFrozen;                                               //0x7f4
    UCHAR PrcbPad3[40];                                                     //0x7f8
    volatile ULONG RequestSummary;                                          //0x820
    struct _KPRCB* SignalDone;                                              //0x824
    UCHAR PrcbPad4[56];                                                     //0x828
    struct _LIST_ENTRY DpcListHead;                                         //0x860
    VOID* DpcStack;                                                         //0x868
    ULONG DpcCount;                                                         //0x86c
    volatile ULONG DpcQueueDepth;                                           //0x870
    volatile ULONG DpcRoutineActive;                                        //0x874
    volatile ULONG DpcInterruptRequested;                                   //0x878
    ULONG DpcLastCount;                                                     //0x87c
    ULONG DpcRequestRate;                                                   //0x880
    ULONG MaximumDpcQueueDepth;                                             //0x884
    ULONG MinimumDpcRate;                                                   //0x888
    ULONG QuantumEnd;                                                       //0x88c
    UCHAR PrcbPad5[16];                                                     //0x890
    ULONG DpcLock;                                                          //0x8a0
    UCHAR PrcbPad6[28];                                                     //0x8a4
    struct _KDPC CallDpc;                                                   //0x8c0
    VOID* ChainedInterruptList;                                             //0x8e0
    LONG LookasideIrpFloat;                                                 //0x8e4
    ULONG SpareFields0[6];                                                  //0x8e8
    UCHAR VendorString[13];                                                 //0x900
    UCHAR InitialApicId;                                                    //0x90d
    UCHAR LogicalProcessorsPerPhysicalProcessor;                            //0x90e
    ULONG MHz;                                                              //0x910
    ULONG FeatureBits;                                                      //0x914
    union _LARGE_INTEGER UpdateSignature;                                   //0x918
    struct _FX_SAVE_AREA NpxSaveArea;                                       //0x920
    struct _PROCESSOR_POWER_STATE PowerState;                               //0xb30
};



typedef  struct _KPCR_XP
{
    struct _NT_TIB NtTib;                                                   //0x0
    struct _KPCR* SelfPcr;                                                  //0x1c
    struct _KPRCB* Prcb;                                                    //0x20
    UCHAR Irql;                                                             //0x24
    ULONG IRR;                                                              //0x28
    ULONG IrrActive;                                                        //0x2c
    ULONG IDR;                                                              //0x30
    VOID* KdVersionBlock;                                                   //0x34
    struct _KIDTENTRY* IDT;                                                 //0x38
    struct _KGDTENTRY* GDT;                                                 //0x3c
    struct _KTSS* TSS;                                                      //0x40
    USHORT MajorVersion;                                                    //0x44
    USHORT MinorVersion;                                                    //0x46
    ULONG SetMember;                                                        //0x48
    ULONG StallScaleFactor;                                                 //0x4c
    UCHAR DebugActive;                                                      //0x50
    UCHAR Number;                                                           //0x51
    UCHAR Spare0;                                                           //0x52
    UCHAR SecondLevelCacheAssociativity;                                    //0x53
    ULONG VdmAlert;                                                         //0x54
    ULONG KernelReserved[14];                                               //0x58
    ULONG SecondLevelCacheSize;                                             //0x90
    ULONG HalReserved[16];                                                  //0x94
    ULONG InterruptMode;                                                    //0xd4
    UCHAR Spare1;                                                           //0xd8
    ULONG KernelReserved2[17];                                              //0xdc
    struct _KPRCB PrcbData;                                                 //0x120
} KPCR_XP,*PKPCR_XP;

#else

//0x8 bytes (sizeof)
struct _EX_PUSH_LOCK
{
    union
    {
        struct
        {
            ULONGLONG Locked : 1;                                             //0x0
            ULONGLONG Waiting : 1;                                            //0x0
            ULONGLONG Waking : 1;                                             //0x0
            ULONGLONG MultipleShared : 1;                                     //0x0
            ULONGLONG Shared : 60;                                            //0x0
        };
        ULONGLONG Value;                                                    //0x0
        VOID* Ptr;                                                          //0x0
    };
};


//0x8 bytes (sizeof)
struct _JOBOBJECT_WAKE_FILTER
{
    ULONG HighEdgeFilter;                                                   //0x0
    ULONG LowEdgeFilter;                                                    //0x4
};

//0x30 bytes (sizeof)
struct _PS_PROCESS_WAKE_INFORMATION
{
    ULONGLONG NotificationChannel;                                          //0x0
    ULONG WakeCounters[7];                                                  //0x8
    struct _JOBOBJECT_WAKE_FILTER WakeFilter;                               //0x24
    ULONG NoWakeCounter;                                                    //0x2c
};


//0x1 bytes (sizeof)
union _KEXECUTE_OPTIONS
{
    UCHAR ExecuteDisable : 1;                                                 //0x0
    UCHAR ExecuteEnable : 1;                                                  //0x0
    UCHAR DisableThunkEmulation : 1;                                          //0x0
    UCHAR Permanent : 1;                                                      //0x0
    UCHAR ExecuteDispatchEnable : 1;                                          //0x0
    UCHAR ImageDispatchEnable : 1;                                            //0x0
    UCHAR DisableExceptionChainValidation : 1;                                //0x0
    UCHAR Spare : 1;                                                          //0x0
    volatile UCHAR ExecuteOptions;                                          //0x0
    UCHAR ExecuteOptionsNV;                                                 //0x0
};

//0xa8 bytes (sizeof)
struct _KAFFINITY_EX
{
    USHORT Count;                                                           //0x0
    USHORT Size;                                                            //0x2
    ULONG Reserved;                                                         //0x4
    ULONGLONG Bitmap[20];                                                   //0x8
};

//0x4 bytes (sizeof)
union _KSTACK_COUNT
{
    LONG Value;                                                             //0x0
    ULONG State : 3;                                                          //0x0
    ULONG StackCount : 29;                                                    //0x0
};

//0x50 bytes (sizeof)
struct _MMSUPPORT_SHARED
{
    volatile LONG WorkingSetLock;                                           //0x0
    LONG GoodCitizenWaiting;                                                //0x4
    ULONGLONG ReleasedCommitDebt;                                           //0x8
    ULONGLONG ResetPagesRepurposedCount;                                    //0x10
    VOID* WsSwapSupport;                                                    //0x18
    VOID* CommitReleaseContext;                                             //0x20
    volatile LONG WorkingSetCoreLock;                                       //0x28
    VOID* AccessLog;                                                        //0x30
    volatile ULONGLONG ChargedWslePages;                                    //0x38
    ULONGLONG ActualWslePages;                                              //0x40
    VOID* ShadowMapping;                                                    //0x48
};

//0x4 bytes (sizeof)
struct _MMSUPPORT_FLAGS
{
    union
    {
        struct
        {
            UCHAR WorkingSetType : 3;                                         //0x0
            UCHAR Reserved0 : 3;                                              //0x0
            UCHAR MaximumWorkingSetHard : 1;                                  //0x0
            UCHAR MinimumWorkingSetHard : 1;                                  //0x0
            UCHAR SessionMaster : 1;                                          //0x1
            UCHAR TrimmerState : 2;                                           //0x1
            UCHAR Reserved : 1;                                               //0x1
            UCHAR PageStealers : 4;                                           //0x1
        };
        USHORT u1;                                                          //0x0
    };
    UCHAR MemoryPriority;                                                   //0x2
    union
    {
        struct
        {
            UCHAR WsleDeleted : 1;                                            //0x3
            UCHAR SvmEnabled : 1;                                             //0x3
            UCHAR ForceAge : 1;                                               //0x3
            UCHAR ForceTrim : 1;                                              //0x3
            UCHAR NewMaximum : 1;                                             //0x3
            UCHAR CommitReleaseState : 2;                                     //0x3
        };
        UCHAR u2;                                                           //0x3
    };
};
//0xc0 bytes (sizeof)
struct _MMSUPPORT_INSTANCE
{
    ULONG NextPageColor;                                                    //0x0
    ULONG PageFaultCount;                                                   //0x4
    ULONGLONG TrimmedPageCount;                                             //0x8
    struct _MMWSL_INSTANCE* VmWorkingSetList;                               //0x10
    struct _LIST_ENTRY WorkingSetExpansionLinks;                            //0x18
    ULONGLONG AgeDistribution[8];                                           //0x28
    struct _KGATE* ExitOutswapGate;                                         //0x68
    ULONGLONG MinimumWorkingSetSize;                                        //0x70
    ULONGLONG WorkingSetLeafSize;                                           //0x78
    ULONGLONG WorkingSetLeafPrivateSize;                                    //0x80
    ULONGLONG WorkingSetSize;                                               //0x88
    ULONGLONG WorkingSetPrivateSize;                                        //0x90
    ULONGLONG MaximumWorkingSetSize;                                        //0x98
    ULONGLONG PeakWorkingSetSize;                                           //0xa0
    ULONG HardFaultCount;                                                   //0xa8
    USHORT LastTrimStamp;                                                   //0xac
    USHORT PartitionId;                                                     //0xae
    ULONGLONG SelfmapLock;                                                  //0xb0
    struct _MMSUPPORT_FLAGS Flags;                                          //0xb8
};
//0x110 bytes (sizeof)
struct _MMSUPPORT_FULL
{
    struct _MMSUPPORT_INSTANCE Instance;                                    //0x0
    struct _MMSUPPORT_SHARED Shared;                                        //0xc0
};

//0x10 bytes (sizeof)
struct _RTL_RB_TREE
{
    struct _RTL_BALANCED_NODE* Root;                                        //0x0
    union
    {
        UCHAR Encoded : 1;                                                    //0x8
        struct _RTL_BALANCED_NODE* Min;                                     //0x8
    };
};

//0x1 bytes (sizeof)
struct _PS_PROTECTION
{
    union
    {
        UCHAR Level;                                                        //0x0
        struct
        {
            UCHAR Type : 3;                                                   //0x0
            UCHAR Audit : 1;                                                  //0x0
            UCHAR Signer : 4;                                                 //0x0
        };
    };
};
//0x2d8 bytes (sizeof)
typedef struct _KPROCESS
{
    struct _DISPATCHER_HEADER Header;                                       //0x0
    struct _LIST_ENTRY ProfileListHead;                                     //0x18
    ULONGLONG DirectoryTableBase;                                           //0x28
    struct _LIST_ENTRY ThreadListHead;                                      //0x30
    ULONG ProcessLock;                                                      //0x40
    ULONG ProcessTimerDelay;                                                //0x44
    ULONGLONG DeepFreezeStartTime;                                          //0x48
    struct _KAFFINITY_EX Affinity;                                          //0x50
    struct _LIST_ENTRY ReadyListHead;                                       //0xf8
    struct _SINGLE_LIST_ENTRY SwapListEntry;                                //0x108
    volatile struct _KAFFINITY_EX ActiveProcessors;                         //0x110
    union
    {
        struct
        {
            ULONG AutoAlignment : 1;                                          //0x1b8
            ULONG DisableBoost : 1;                                           //0x1b8
            ULONG DisableQuantum : 1;                                         //0x1b8
            ULONG DeepFreeze : 1;                                             //0x1b8
            ULONG TimerVirtualization : 1;                                    //0x1b8
            ULONG CheckStackExtents : 1;                                      //0x1b8
            ULONG CacheIsolationEnabled : 1;                                  //0x1b8
            ULONG PpmPolicy : 3;                                              //0x1b8
            ULONG ActiveGroupsMask : 20;                                      //0x1b8
            ULONG VaSpaceDeleted : 1;                                         //0x1b8
            ULONG ReservedFlags : 1;                                          //0x1b8
        };
        volatile LONG ProcessFlags;                                         //0x1b8
    };
    CHAR BasePriority;                                                      //0x1bc
    CHAR QuantumReset;                                                      //0x1bd
    CHAR Visited;                                                           //0x1be
    union _KEXECUTE_OPTIONS Flags;                                          //0x1bf
    ULONG ThreadSeed[20];                                                   //0x1c0
    USHORT IdealNode[20];                                                   //0x210
    USHORT IdealGlobalNode;                                                 //0x238
    USHORT Spare1;                                                          //0x23a
    union  _KSTACK_COUNT StackCount;                                 //0x23c
    struct _LIST_ENTRY ProcessListEntry;                                    //0x240
    ULONGLONG CycleTime;                                                    //0x250
    ULONGLONG ContextSwitches;                                              //0x258
    struct _KSCHEDULING_GROUP* SchedulingGroup;                             //0x260
    ULONG FreezeCount;                                                      //0x268
    ULONG KernelTime;                                                       //0x26c
    ULONG UserTime;                                                         //0x270
    ULONG ReadyTime;                                                        //0x274
    ULONGLONG UserDirectoryTableBase;                                       //0x278
    UCHAR AddressPolicy;                                                    //0x280
    UCHAR Spare2[71];                                                       //0x281
    VOID* InstrumentationCallback;                                          //0x2c8
    union
    {
        ULONGLONG SecureHandle;                                             //0x2d0
        struct
        {
            ULONGLONG SecureProcess : 1;                                      //0x2d0
            ULONGLONG Unused : 1;                                             //0x2d0
        } Flags;                                                            //0x2d0
    } SecureState;                                                          //0x2d0
}KPROCESS_WIN1803,*PKPROCESS_WIN1803;


//0x8 bytes (sizeof)
struct _EX_FAST_REF
{
    union
    {
        VOID* Object;                                                       //0x0
        ULONGLONG RefCnt : 4;                                                 //0x0
        ULONGLONG Value;                                                    //0x0
    };
};
//0x1 bytes (sizeof)
union _KWAIT_STATUS_REGISTER
{
    UCHAR Flags;                                                            //0x0
    UCHAR State : 3;                                                          //0x0
    UCHAR Affinity : 1;                                                       //0x0
    UCHAR Priority : 1;                                                       //0x0
    UCHAR Apc : 1;                                                            //0x0
    UCHAR UserApc : 1;                                                        //0x0
    UCHAR Alert : 1;                                                          //0x0
};
//0x8 bytes (sizeof)
struct _RTL_AVL_TREE
{
    struct _RTL_BALANCED_NODE* Root;                                        //0x0
};
//0x10 bytes (sizeof)
struct _KLOCK_ENTRY_LOCK_STATE
{
    union
    {
        struct
        {
            ULONGLONG CrossThreadReleasable : 1;                              //0x0
            ULONGLONG Busy : 1;                                               //0x0
            ULONGLONG Reserved : 61;                                          //0x0
            ULONGLONG InTree : 1;                                             //0x0
        };
        VOID* LockState;                                                    //0x0
    };
    union
    {
        VOID* SessionState;                                                 //0x8
        struct
        {
            ULONG SessionId;                                                //0x8
            ULONG SessionPad;                                               //0xc
        };
    };
};
//0x8 bytes (sizeof)
struct _SE_AUDIT_PROCESS_CREATION_INFO
{
    struct _OBJECT_NAME_INFORMATION* ImageFileName;                         //0x0
};

//0x8 bytes (sizeof)
union _PS_INTERLOCKED_TIMER_DELAY_VALUES
{
    ULONGLONG DelayMs : 30;                                                   //0x0
    ULONGLONG CoalescingWindowMs : 30;                                        //0x0
    ULONGLONG Reserved : 1;                                                   //0x0
    ULONGLONG NewTimerWheel : 1;                                              //0x0
    ULONGLONG Retry : 1;                                                      //0x0
    ULONGLONG Locked : 1;                                                     //0x0
    ULONGLONG All;                                                          //0x0
};


//0x4 bytes (sizeof)
union _KLOCK_ENTRY_BOOST_BITMAP
{
    ULONG AllFields;                                                        //0x0
    ULONG AllBoosts : 17;                                                     //0x0
    ULONG Reserved : 15;                                                      //0x0
    USHORT CpuBoostsBitmap : 15;                                              //0x0
    struct
    {
        USHORT IoBoost : 1;                                                   //0x0
        USHORT IoQoSBoost : 1;                                                    //0x2
        USHORT IoNormalPriorityWaiterCount : 8;                                   //0x2
    };
    USHORT IoQoSWaiterCount : 7;                                              //0x2
};

//0x20 bytes (sizeof)
struct _ALPC_PROCESS_CONTEXT
{
    struct _EX_PUSH_LOCK Lock;                                              //0x0
    struct _LIST_ENTRY ViewListHead;                                        //0x8
    volatile ULONGLONG PagedPoolQuotaCache;                                 //0x18
};
//0x60 bytes (sizeof)
struct _KLOCK_ENTRY
{
    union
    {
        struct _RTL_BALANCED_NODE TreeNode;                                 //0x0
        struct _SINGLE_LIST_ENTRY FreeListEntry;                            //0x0
    };
    union
    {
        ULONG EntryFlags;                                                   //0x18
        struct
        {
            UCHAR EntryOffset;                                              //0x18
            union
            {
                UCHAR ThreadLocalFlags;                                     //0x19
                struct
                {
                    UCHAR WaitingBit : 1;                                     //0x19
                    UCHAR Spare0 : 7;                                         //0x19
                };
            };
            union
            {
                UCHAR AcquiredByte;                                         //0x1a
                UCHAR AcquiredBit : 1;                                        //0x1a
            };
            union
            {
                UCHAR CrossThreadFlags;                                     //0x1b
                struct
                {
                    UCHAR HeadNodeBit : 1;                                    //0x1b
                    UCHAR IoPriorityBit : 1;                                  //0x1b
                    UCHAR IoQoSWaiter : 1;                                    //0x1b
                    UCHAR Spare1 : 5;                                         //0x1b
                };
            };
        };
        struct
        {
            ULONG StaticState : 8;                                            //0x18
            ULONG AllFlags : 24;                                              //0x18
        };
    };
    ULONG SpareFlags;                                                       //0x1c
    union
    {
        struct _KLOCK_ENTRY_LOCK_STATE LockState;                           //0x20
        VOID* volatile LockUnsafe;                                          //0x20
        struct
        {
            volatile UCHAR CrossThreadReleasableAndBusyByte;                //0x20
            UCHAR Reserved[6];                                              //0x21
            volatile UCHAR InTreeByte;                                      //0x27
            union
            {
                VOID* SessionState;                                         //0x28
                struct
                {
                    ULONG SessionId;                                        //0x28
                    ULONG SessionPad;                                       //0x2c
                };
            };
        };
    };
    union
    {
        struct
        {
            struct _RTL_RB_TREE OwnerTree;                                  //0x30
            struct _RTL_RB_TREE WaiterTree;                                 //0x40
        };
        CHAR CpuPriorityKey;                                                //0x30
    };
    ULONGLONG EntryLock;                                                    //0x50
    union _KLOCK_ENTRY_BOOST_BITMAP BoostBitmap;                            //0x58
    ULONG SparePad;                                                         //0x5c
};

//0x5f0 bytes (sizeof)
typedef struct _KTHREAD_WIN1803
{
    struct _DISPATCHER_HEADER Header;                                       //0x0
    VOID* SListFaultAddress;                                                //0x18
    ULONGLONG QuantumTarget;                                                //0x20
    VOID* InitialStack;                                                     //0x28
    VOID* volatile StackLimit;                                              //0x30
    VOID* StackBase;                                                        //0x38
    ULONGLONG ThreadLock;                                                   //0x40
    volatile ULONGLONG CycleTime;                                           //0x48
    ULONG CurrentRunTime;                                                   //0x50
    ULONG ExpectedRunTime;                                                  //0x54
    VOID* KernelStack;                                                      //0x58
    struct _XSAVE_FORMAT* StateSaveArea;                                    //0x60
    struct _KSCHEDULING_GROUP* volatile SchedulingGroup;                    //0x68
    union _KWAIT_STATUS_REGISTER WaitRegister;                              //0x70
    volatile UCHAR Running;                                                 //0x71
    UCHAR Alerted[2];                                                       //0x72
    union
    {
        struct
        {
            ULONG AutoBoostActive : 1;                                        //0x74
            ULONG ReadyTransition : 1;                                        //0x74
            ULONG WaitNext : 1;                                               //0x74
            ULONG SystemAffinityActive : 1;                                   //0x74
            ULONG Alertable : 1;                                              //0x74
            ULONG UserStackWalkActive : 1;                                    //0x74
            ULONG ApcInterruptRequest : 1;                                    //0x74
            ULONG QuantumEndMigrate : 1;                                      //0x74
            ULONG UmsDirectedSwitchEnable : 1;                                //0x74
            ULONG TimerActive : 1;                                            //0x74
            ULONG SystemThread : 1;                                           //0x74
            ULONG ProcessDetachActive : 1;                                    //0x74
            ULONG CalloutActive : 1;                                          //0x74
            ULONG ScbReadyQueue : 1;                                          //0x74
            ULONG ApcQueueable : 1;                                           //0x74
            ULONG ReservedStackInUse : 1;                                     //0x74
            ULONG UmsPerformingSyscall : 1;                                   //0x74
            ULONG TimerSuspended : 1;                                         //0x74
            ULONG SuspendedWaitMode : 1;                                      //0x74
            ULONG SuspendSchedulerApcWait : 1;                                //0x74
            ULONG Reserved : 12;                                              //0x74
        };
        LONG MiscFlags;                                                     //0x74
    };
    union
    {
        struct
        {
            ULONG BamQosLevel : 2;                                            //0x78
            ULONG AutoAlignment : 1;                                          //0x78
            ULONG DisableBoost : 1;                                           //0x78
            ULONG AlertedByThreadId : 1;                                      //0x78
            ULONG QuantumDonation : 1;                                        //0x78
            ULONG EnableStackSwap : 1;                                        //0x78
            ULONG GuiThread : 1;                                              //0x78
            ULONG DisableQuantum : 1;                                         //0x78
            ULONG ChargeOnlySchedulingGroup : 1;                              //0x78
            ULONG DeferPreemption : 1;                                        //0x78
            ULONG QueueDeferPreemption : 1;                                   //0x78
            ULONG ForceDeferSchedule : 1;                                     //0x78
            ULONG SharedReadyQueueAffinity : 1;                               //0x78
            ULONG FreezeCount : 1;                                            //0x78
            ULONG TerminationApcRequest : 1;                                  //0x78
            ULONG AutoBoostEntriesExhausted : 1;                              //0x78
            ULONG KernelStackResident : 1;                                    //0x78
            ULONG TerminateRequestReason : 2;                                 //0x78
            ULONG ProcessStackCountDecremented : 1;                           //0x78
            ULONG RestrictedGuiThread : 1;                                    //0x78
            ULONG VpBackingThread : 1;                                        //0x78
            ULONG ThreadFlagsSpare : 1;                                       //0x78
            ULONG EtwStackTraceApcInserted : 8;                               //0x78
        };
        volatile LONG ThreadFlags;                                          //0x78
    };
    volatile UCHAR Tag;                                                     //0x7c
    UCHAR SystemHeteroCpuPolicy;                                            //0x7d
    UCHAR UserHeteroCpuPolicy : 7;                                            //0x7e
    UCHAR ExplicitSystemHeteroCpuPolicy : 1;                                  //0x7e
    UCHAR Spare0;                                                           //0x7f
    ULONG SystemCallNumber;                                                 //0x80
    ULONG ReadyTime;                                                        //0x84
    VOID* FirstArgument;                                                    //0x88
    struct _KTRAP_FRAME* TrapFrame;                                         //0x90
    union
    {
        struct _KAPC_STATE ApcState;                                        //0x98
        struct
        {
            UCHAR ApcStateFill[43];                                         //0x98
            CHAR Priority;                                                  //0xc3
            ULONG UserIdealProcessor;                                       //0xc4
        };
    };
    volatile LONGLONG WaitStatus;                                           //0xc8
    struct _KWAIT_BLOCK* WaitBlockList;                                     //0xd0
    union
    {
        struct _LIST_ENTRY WaitListEntry;                                   //0xd8
        struct _SINGLE_LIST_ENTRY SwapListEntry;                            //0xd8
    };
    struct _DISPATCHER_HEADER* volatile Queue;                              //0xe8
    VOID* Teb;                                                              //0xf0
    ULONGLONG RelativeTimerBias;                                            //0xf8
    struct _KTIMER Timer;                                                   //0x100
    union
    {
        struct _KWAIT_BLOCK WaitBlock[4];                                   //0x140
        struct
        {
            UCHAR WaitBlockFill4[20];                                       //0x140
            ULONG ContextSwitches;                                          //0x154
        };
        struct
        {
            UCHAR WaitBlockFill5[68];                                       //0x140
            volatile UCHAR State;                                           //0x184
            CHAR Spare13;                                                   //0x185
            UCHAR WaitIrql;                                                 //0x186
            CHAR WaitMode;                                                  //0x187
        };
        struct
        {
            UCHAR WaitBlockFill6[116];                                      //0x140
            ULONG WaitTime;                                                 //0x1b4
        };
        struct
        {
            UCHAR WaitBlockFill7[164];                                      //0x140
            union
            {
                struct
                {
                    SHORT KernelApcDisable;                                 //0x1e4
                    SHORT SpecialApcDisable;                                //0x1e6
                };
                ULONG CombinedApcDisable;                                   //0x1e4
            };
        };
        struct
        {
            UCHAR WaitBlockFill8[40];                                       //0x140
            struct _KTHREAD_COUNTERS* ThreadCounters;                       //0x168
        };
        struct
        {
            UCHAR WaitBlockFill9[88];                                       //0x140
            struct _XSTATE_SAVE* XStateSave;                                //0x198
        };
        struct
        {
            UCHAR WaitBlockFill10[136];                                     //0x140
            VOID* volatile Win32Thread;                                     //0x1c8
        };
        struct
        {
            UCHAR WaitBlockFill11[176];                                     //0x140
            struct _UMS_CONTROL_BLOCK* Ucb;                                 //0x1f0
            struct _KUMS_CONTEXT_HEADER* volatile Uch;                      //0x1f8
        };
    };
    VOID* Spare21;                                                          //0x200
    struct _LIST_ENTRY QueueListEntry;                                      //0x208
    union
    {
        volatile ULONG NextProcessor;                                       //0x218
        struct
        {
            ULONG NextProcessorNumber : 31;                                   //0x218
            ULONG SharedReadyQueue : 1;                                       //0x218
        };
    };
    LONG QueuePriority;                                                     //0x21c
    struct _KPROCESS* Process;                                              //0x220
    union
    {
        struct _GROUP_AFFINITY UserAffinity;                                //0x228
        struct
        {
            UCHAR UserAffinityFill[10];                                     //0x228
            CHAR PreviousMode;                                              //0x232
            CHAR BasePriority;                                              //0x233
            union
            {
                CHAR PriorityDecrement;                                     //0x234
                struct
                {
                    UCHAR ForegroundBoost : 4;                                //0x234
                    UCHAR UnusualBoost : 4;                                   //0x234
                };
            };
            UCHAR Preempted;                                                //0x235
            UCHAR AdjustReason;                                             //0x236
            CHAR AdjustIncrement;                                           //0x237
        };
    };
    ULONGLONG AffinityVersion;                                              //0x238
    union
    {
        struct _GROUP_AFFINITY Affinity;                                    //0x240
        struct
        {
            UCHAR AffinityFill[10];                                         //0x240
            UCHAR ApcStateIndex;                                            //0x24a
            UCHAR WaitBlockCount;                                           //0x24b
            ULONG IdealProcessor;                                           //0x24c
        };
    };
    ULONGLONG NpxState;                                                     //0x250
    union
    {
        struct _KAPC_STATE SavedApcState;                                   //0x258
        struct
        {
            UCHAR SavedApcStateFill[43];                                    //0x258
            UCHAR WaitReason;                                               //0x283
            CHAR SuspendCount;                                              //0x284
            CHAR Saturation;                                                //0x285
            USHORT SListFaultCount;                                         //0x286
        };
    };
    union
    {
        struct _KAPC SchedulerApc;                                          //0x288
        struct
        {
            UCHAR SchedulerApcFill0[1];                                     //0x288
            UCHAR ResourceIndex;                                            //0x289
        };
        struct
        {
            UCHAR SchedulerApcFill1[3];                                     //0x288
            UCHAR QuantumReset;                                             //0x28b
        };
        struct
        {
            UCHAR SchedulerApcFill2[4];                                     //0x288
            ULONG KernelTime;                                               //0x28c
        };
        struct
        {
            UCHAR SchedulerApcFill3[64];                                    //0x288
            struct _KPRCB* volatile WaitPrcb;                               //0x2c8
        };
        struct
        {
            UCHAR SchedulerApcFill4[72];                                    //0x288
            VOID* LegoData;                                                 //0x2d0
        };
        struct
        {
            UCHAR SchedulerApcFill5[83];                                    //0x288
            UCHAR CallbackNestingLevel;                                     //0x2db
            ULONG UserTime;                                                 //0x2dc
        };
    };
    struct _KEVENT SuspendEvent;                                            //0x2e0
    struct _LIST_ENTRY ThreadListEntry;                                     //0x2f8
    struct _LIST_ENTRY MutantListHead;                                      //0x308
    UCHAR AbEntrySummary;                                                   //0x318
    UCHAR AbWaitEntryCount;                                                 //0x319
    UCHAR AbAllocationRegionCount;                                          //0x31a
    CHAR SystemPriority;                                                    //0x31b
    ULONG SecureThreadCookie;                                               //0x31c
    struct _KLOCK_ENTRY LockEntries[6];                                     //0x320
    struct _SINGLE_LIST_ENTRY PropagateBoostsEntry;                         //0x560
    struct _SINGLE_LIST_ENTRY IoSelfBoostsEntry;                            //0x568
    UCHAR PriorityFloorCounts[16];                                          //0x570
    ULONG PriorityFloorSummary;                                             //0x580
    volatile LONG AbCompletedIoBoostCount;                                  //0x584
    volatile LONG AbCompletedIoQoSBoostCount;                               //0x588
    volatile SHORT KeReferenceCount;                                        //0x58c
    UCHAR AbOrphanedEntrySummary;                                           //0x58e
    UCHAR AbOwnedEntryCount;                                                //0x58f
    ULONG ForegroundLossTime;                                               //0x590
    union
    {
        struct _LIST_ENTRY GlobalForegroundListEntry;                       //0x598
        struct
        {
            struct _SINGLE_LIST_ENTRY ForegroundDpcStackListEntry;          //0x598
            ULONGLONG InGlobalForegroundList;                               //0x5a0
        };
    };
    LONGLONG ReadOperationCount;                                            //0x5a8
    LONGLONG WriteOperationCount;                                           //0x5b0
    LONGLONG OtherOperationCount;                                           //0x5b8
    LONGLONG ReadTransferCount;                                             //0x5c0
    LONGLONG WriteTransferCount;                                            //0x5c8
    LONGLONG OtherTransferCount;                                            //0x5d0
    struct _KSCB* QueuedScb;                                                //0x5d8
    volatile ULONG ThreadTimerDelay;                                        //0x5e0
    union
    {
        volatile LONG ThreadFlags2;                                         //0x5e4
        struct
        {
            ULONG PpmPolicy : 2;                                              //0x5e4
            ULONG ThreadFlags2Reserved : 30;                                  //0x5e4
        };
    };
    VOID* SchedulerAssist;                                                  //0x5e8
}KTHREAD_WIN1803, *PKTHREAD_WIN1803;


//0x848 bytes (sizeof)
typedef struct _EPROCESS
{
    struct _KPROCESS Pcb;                                                   //0x0
    struct _EX_PUSH_LOCK ProcessLock;                                       //0x2d8
    VOID* UniqueProcessId;                                                  //0x2e0
    struct _LIST_ENTRY ActiveProcessLinks;                                  //0x2e8
    struct _EX_RUNDOWN_REF RundownProtect;                                  //0x2f8
    union
    {
        ULONG Flags2;                                                       //0x300
        struct
        {
            ULONG JobNotReallyActive : 1;                                     //0x300
            ULONG AccountingFolded : 1;                                       //0x300
            ULONG NewProcessReported : 1;                                     //0x300
            ULONG ExitProcessReported : 1;                                    //0x300
            ULONG ReportCommitChanges : 1;                                    //0x300
            ULONG LastReportMemory : 1;                                       //0x300
            ULONG ForceWakeCharge : 1;                                        //0x300
            ULONG CrossSessionCreate : 1;                                     //0x300
            ULONG NeedsHandleRundown : 1;                                     //0x300
            ULONG RefTraceEnabled : 1;                                        //0x300
            ULONG PicoCreated : 1;                                            //0x300
            ULONG EmptyJobEvaluated : 1;                                      //0x300
            ULONG DefaultPagePriority : 3;                                    //0x300
            ULONG PrimaryTokenFrozen : 1;                                     //0x300
            ULONG ProcessVerifierTarget : 1;                                  //0x300
            ULONG RestrictSetThreadContext : 1;                               //0x300
            ULONG AffinityPermanent : 1;                                      //0x300
            ULONG AffinityUpdateEnable : 1;                                   //0x300
            ULONG PropagateNode : 1;                                          //0x300
            ULONG ExplicitAffinity : 1;                                       //0x300
            ULONG ProcessExecutionState : 2;                                  //0x300
            ULONG EnableReadVmLogging : 1;                                    //0x300
            ULONG EnableWriteVmLogging : 1;                                   //0x300
            ULONG FatalAccessTerminationRequested : 1;                        //0x300
            ULONG DisableSystemAllowedCpuSet : 1;                             //0x300
            ULONG ProcessStateChangeRequest : 2;                              //0x300
            ULONG ProcessStateChangeInProgress : 1;                           //0x300
            ULONG InPrivate : 1;                                              //0x300
        };
    };
    union
    {
        ULONG Flags;                                                        //0x304
        struct
        {
            ULONG CreateReported : 1;                                         //0x304
            ULONG NoDebugInherit : 1;                                         //0x304
            ULONG ProcessExiting : 1;                                         //0x304
            ULONG ProcessDelete : 1;                                          //0x304
            ULONG ManageExecutableMemoryWrites : 1;                           //0x304
            ULONG VmDeleted : 1;                                              //0x304
            ULONG OutswapEnabled : 1;                                         //0x304
            ULONG Outswapped : 1;                                             //0x304
            ULONG FailFastOnCommitFail : 1;                                   //0x304
            ULONG Wow64VaSpace4Gb : 1;                                        //0x304
            ULONG AddressSpaceInitialized : 2;                                //0x304
            ULONG SetTimerResolution : 1;                                     //0x304
            ULONG BreakOnTermination : 1;                                     //0x304
            ULONG DeprioritizeViews : 1;                                      //0x304
            ULONG WriteWatch : 1;                                             //0x304
            ULONG ProcessInSession : 1;                                       //0x304
            ULONG OverrideAddressSpace : 1;                                   //0x304
            ULONG HasAddressSpace : 1;                                        //0x304
            ULONG LaunchPrefetched : 1;                                       //0x304
            ULONG Background : 1;                                             //0x304
            ULONG VmTopDown : 1;                                              //0x304
            ULONG ImageNotifyDone : 1;                                        //0x304
            ULONG PdeUpdateNeeded : 1;                                        //0x304
            ULONG VdmAllowed : 1;                                             //0x304
            ULONG ProcessRundown : 1;                                         //0x304
            ULONG ProcessInserted : 1;                                        //0x304
            ULONG DefaultIoPriority : 3;                                      //0x304
            ULONG ProcessSelfDelete : 1;                                      //0x304
            ULONG SetTimerResolutionLink : 1;                                 //0x304
        };
    };
    union _LARGE_INTEGER CreateTime;                                        //0x308
    ULONGLONG ProcessQuotaUsage[2];                                         //0x310
    ULONGLONG ProcessQuotaPeak[2];                                          //0x320
    ULONGLONG PeakVirtualSize;                                              //0x330
    ULONGLONG VirtualSize;                                                  //0x338
    struct _LIST_ENTRY SessionProcessLinks;                                 //0x340
    union
    {
        VOID* ExceptionPortData;                                            //0x350
        ULONGLONG ExceptionPortValue;                                       //0x350
        ULONGLONG ExceptionPortState : 3;                                     //0x350
    };
    struct _EX_FAST_REF Token;                                              //0x358
    ULONGLONG MmReserved;                                                   //0x360
    struct _EX_PUSH_LOCK AddressCreationLock;                               //0x368
    struct _EX_PUSH_LOCK PageTableCommitmentLock;                           //0x370
    struct _ETHREAD* RotateInProgress;                                      //0x378
    struct _ETHREAD* ForkInProgress;                                        //0x380
    struct _EJOB* volatile CommitChargeJob;                                 //0x388
    struct _RTL_AVL_TREE CloneRoot;                                         //0x390
    volatile ULONGLONG NumberOfPrivatePages;                                //0x398
    volatile ULONGLONG NumberOfLockedPages;                                 //0x3a0
    VOID* Win32Process;                                                     //0x3a8
    struct _EJOB* volatile Job;                                             //0x3b0
    VOID* SectionObject;                                                    //0x3b8
    VOID* SectionBaseAddress;                                               //0x3c0
    ULONG Cookie;                                                           //0x3c8
    struct _PAGEFAULT_HISTORY* WorkingSetWatch;                             //0x3d0
    VOID* Win32WindowStation;                                               //0x3d8
    VOID* InheritedFromUniqueProcessId;                                     //0x3e0
    VOID* LdtInformation;                                                   //0x3e8
    volatile ULONGLONG OwnerProcessId;                                      //0x3f0
    struct _PEB* Peb;                                                       //0x3f8
    struct _MM_SESSION_SPACE* Session;                                      //0x400
    VOID* AweInfo;                                                          //0x408
    struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;                               //0x410
    struct _HANDLE_TABLE* ObjectTable;                                      //0x418
    VOID* DebugPort;                                                        //0x420
    struct _EWOW64PROCESS* WoW64Process;                                    //0x428
    VOID* DeviceMap;                                                        //0x430
    VOID* EtwDataSource;                                                    //0x438
    ULONGLONG PageDirectoryPte;                                             //0x440
    struct _FILE_OBJECT* ImageFilePointer;                                  //0x448
    UCHAR ImageFileName[15];                                                //0x450
    UCHAR PriorityClass;                                                    //0x45f
    VOID* SecurityPort;                                                     //0x460
    struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;      //0x468
    struct _LIST_ENTRY JobLinks;                                            //0x470
    VOID* HighestUserAddress;                                               //0x480
    struct _LIST_ENTRY ThreadListHead;                                      //0x488
    volatile ULONG ActiveThreads;                                           //0x498
    ULONG ImagePathHash;                                                    //0x49c
    ULONG DefaultHardErrorProcessing;                                       //0x4a0
    LONG LastThreadExitStatus;                                              //0x4a4
    struct _EX_FAST_REF PrefetchTrace;                                      //0x4a8
    VOID* LockedPagesList;                                                  //0x4b0
    union _LARGE_INTEGER ReadOperationCount;                                //0x4b8
    union _LARGE_INTEGER WriteOperationCount;                               //0x4c0
    union _LARGE_INTEGER OtherOperationCount;                               //0x4c8
    union _LARGE_INTEGER ReadTransferCount;                                 //0x4d0
    union _LARGE_INTEGER WriteTransferCount;                                //0x4d8
    union _LARGE_INTEGER OtherTransferCount;                                //0x4e0
    ULONGLONG CommitChargeLimit;                                            //0x4e8
    volatile ULONGLONG CommitCharge;                                        //0x4f0
    volatile ULONGLONG CommitChargePeak;                                    //0x4f8
    struct _MMSUPPORT_FULL Vm;                                              //0x500
    struct _LIST_ENTRY MmProcessLinks;                                      //0x610
    ULONG ModifiedPageCount;                                                //0x620
    LONG ExitStatus;                                                        //0x624
    struct _RTL_AVL_TREE VadRoot;                                           //0x628
    VOID* VadHint;                                                          //0x630
    ULONGLONG VadCount;                                                     //0x638
    volatile ULONGLONG VadPhysicalPages;                                    //0x640
    ULONGLONG VadPhysicalPagesLimit;                                        //0x648
    struct _ALPC_PROCESS_CONTEXT AlpcContext;                               //0x650
    struct _LIST_ENTRY TimerResolutionLink;                                 //0x670
    struct _PO_DIAG_STACK_RECORD* TimerResolutionStackRecord;               //0x680
    ULONG RequestedTimerResolution;                                         //0x688
    ULONG SmallestTimerResolution;                                          //0x68c
    union _LARGE_INTEGER ExitTime;                                          //0x690
    struct _INVERTED_FUNCTION_TABLE* InvertedFunctionTable;                 //0x698
    struct _EX_PUSH_LOCK InvertedFunctionTableLock;                         //0x6a0
    ULONG ActiveThreadsHighWatermark;                                       //0x6a8
    ULONG LargePrivateVadCount;                                             //0x6ac
    struct _EX_PUSH_LOCK ThreadListLock;                                    //0x6b0
    VOID* WnfContext;                                                       //0x6b8
    struct _EJOB* ServerSilo;                                               //0x6c0
    UCHAR SignatureLevel;                                                   //0x6c8
    UCHAR SectionSignatureLevel;                                            //0x6c9
    struct _PS_PROTECTION Protection;                                       //0x6ca
    UCHAR HangCount : 4;                                                      //0x6cb
    UCHAR GhostCount : 4;                                                     //0x6cb
    union
    {
        ULONG Flags3;                                                       //0x6cc
        struct
        {
            ULONG Minimal : 1;                                                //0x6cc
            ULONG ReplacingPageRoot : 1;                                      //0x6cc
            ULONG Crashed : 1;                                                //0x6cc
            ULONG JobVadsAreTracked : 1;                                      //0x6cc
            ULONG VadTrackingDisabled : 1;                                    //0x6cc
            ULONG AuxiliaryProcess : 1;                                       //0x6cc
            ULONG SubsystemProcess : 1;                                       //0x6cc
            ULONG IndirectCpuSets : 1;                                        //0x6cc
            ULONG RelinquishedCommit : 1;                                     //0x6cc
            ULONG HighGraphicsPriority : 1;                                   //0x6cc
            ULONG CommitFailLogged : 1;                                       //0x6cc
            ULONG ReserveFailLogged : 1;                                      //0x6cc
            ULONG SystemProcess : 1;                                          //0x6cc
            ULONG HideImageBaseAddresses : 1;                                 //0x6cc
            ULONG AddressPolicyFrozen : 1;                                    //0x6cc
            ULONG ProcessFirstResume : 1;                                     //0x6cc
            ULONG ForegroundExternal : 1;                                     //0x6cc
            ULONG ForegroundSystem : 1;                                       //0x6cc
            ULONG HighMemoryPriority : 1;                                     //0x6cc
        };
    };
    LONG DeviceAsid;                                                        //0x6d0
    VOID* SvmData;                                                          //0x6d8
    struct _EX_PUSH_LOCK SvmProcessLock;                                    //0x6e0
    ULONGLONG SvmLock;                                                      //0x6e8
    struct _LIST_ENTRY SvmProcessDeviceListHead;                            //0x6f0
    ULONGLONG LastFreezeInterruptTime;                                      //0x700
    struct _PROCESS_DISK_COUNTERS* DiskCounters;                            //0x708
    VOID* PicoContext;                                                      //0x710
    ULONGLONG TrustletIdentity;                                             //0x718
    VOID* EnclaveTable;                                                     //0x720
    ULONGLONG EnclaveNumber;                                                //0x728
    struct _EX_PUSH_LOCK EnclaveLock;                                       //0x730
    ULONG HighPriorityFaultsAllowed;                                        //0x738
    struct _PO_PROCESS_ENERGY_CONTEXT* EnergyContext;                       //0x740
    VOID* VmContext;                                                        //0x748
    ULONGLONG SequenceNumber;                                               //0x750
    ULONGLONG CreateInterruptTime;                                          //0x758
    ULONGLONG CreateUnbiasedInterruptTime;                                  //0x760
    ULONGLONG TotalUnbiasedFrozenTime;                                      //0x768
    ULONGLONG LastAppStateUpdateTime;                                       //0x770
    ULONGLONG LastAppStateUptime : 61;                                        //0x778
    ULONGLONG LastAppState : 3;                                               //0x778
    volatile ULONGLONG SharedCommitCharge;                                  //0x780
    struct _EX_PUSH_LOCK SharedCommitLock;                                  //0x788
    struct _LIST_ENTRY SharedCommitLinks;                                   //0x790
    union
    {
        struct
        {
            ULONGLONG AllowedCpuSets;                                       //0x7a0
            ULONGLONG DefaultCpuSets;                                       //0x7a8
        };
        struct
        {
            ULONGLONG* AllowedCpuSetsIndirect;                              //0x7a0
            ULONGLONG* DefaultCpuSetsIndirect;                              //0x7a8
        };
    };
    VOID* DiskIoAttribution;                                                //0x7b0
    VOID* DxgProcess;                                                       //0x7b8
    ULONG Win32KFilterSet;                                                  //0x7c0
    union  _PS_INTERLOCKED_TIMER_DELAY_VALUES ProcessTimerDelay;     //0x7c8
    volatile ULONG KTimerSets;                                              //0x7d0
    volatile ULONG KTimer2Sets;                                             //0x7d4
    volatile ULONG ThreadTimerSets;                                         //0x7d8
    ULONGLONG VirtualTimerListLock;                                         //0x7e0
    struct _LIST_ENTRY VirtualTimerListHead;                                //0x7e8
    union
    {
        struct _WNF_STATE_NAME WakeChannel;                                 //0x7f8
        struct _PS_PROCESS_WAKE_INFORMATION WakeInfo;                       //0x7f8
    };
    union
    {
        ULONG MitigationFlags;                                              //0x828
        struct
        {
            ULONG ControlFlowGuardEnabled : 1;                                //0x828
            ULONG ControlFlowGuardExportSuppressionEnabled : 1;               //0x828
            ULONG ControlFlowGuardStrict : 1;                                 //0x828
            ULONG DisallowStrippedImages : 1;                                 //0x828
            ULONG ForceRelocateImages : 1;                                    //0x828
            ULONG HighEntropyASLREnabled : 1;                                 //0x828
            ULONG StackRandomizationDisabled : 1;                             //0x828
            ULONG ExtensionPointDisable : 1;                                  //0x828
            ULONG DisableDynamicCode : 1;                                     //0x828
            ULONG DisableDynamicCodeAllowOptOut : 1;                          //0x828
            ULONG DisableDynamicCodeAllowRemoteDowngrade : 1;                 //0x828
            ULONG AuditDisableDynamicCode : 1;                                //0x828
            ULONG DisallowWin32kSystemCalls : 1;                              //0x828
            ULONG AuditDisallowWin32kSystemCalls : 1;                         //0x828
            ULONG EnableFilteredWin32kAPIs : 1;                               //0x828
            ULONG AuditFilteredWin32kAPIs : 1;                                //0x828
            ULONG DisableNonSystemFonts : 1;                                  //0x828
            ULONG AuditNonSystemFontLoading : 1;                              //0x828
            ULONG PreferSystem32Images : 1;                                   //0x828
            ULONG ProhibitRemoteImageMap : 1;                                 //0x828
            ULONG AuditProhibitRemoteImageMap : 1;                            //0x828
            ULONG ProhibitLowILImageMap : 1;                                  //0x828
            ULONG AuditProhibitLowILImageMap : 1;                             //0x828
            ULONG SignatureMitigationOptIn : 1;                               //0x828
            ULONG AuditBlockNonMicrosoftBinaries : 1;                         //0x828
            ULONG AuditBlockNonMicrosoftBinariesAllowStore : 1;               //0x828
            ULONG LoaderIntegrityContinuityEnabled : 1;                       //0x828
            ULONG AuditLoaderIntegrityContinuity : 1;                         //0x828
            ULONG EnableModuleTamperingProtection : 1;                        //0x828
            ULONG EnableModuleTamperingProtectionNoInherit : 1;               //0x828
            ULONG Reserved : 1;                                               //0x828
        } MitigationFlagsValues;                                            //0x828
    };
    union
    {
        ULONG MitigationFlags2;                                             //0x82c
        struct
        {
            ULONG EnableExportAddressFilter : 1;                              //0x82c
            ULONG AuditExportAddressFilter : 1;                               //0x82c
            ULONG EnableExportAddressFilterPlus : 1;                          //0x82c
            ULONG AuditExportAddressFilterPlus : 1;                           //0x82c
            ULONG EnableRopStackPivot : 1;                                    //0x82c
            ULONG AuditRopStackPivot : 1;                                     //0x82c
            ULONG EnableRopCallerCheck : 1;                                   //0x82c
            ULONG AuditRopCallerCheck : 1;                                    //0x82c
            ULONG EnableRopSimExec : 1;                                       //0x82c
            ULONG AuditRopSimExec : 1;                                        //0x82c
            ULONG EnableImportAddressFilter : 1;                              //0x82c
            ULONG AuditImportAddressFilter : 1;                               //0x82c
        } MitigationFlags2Values;                                           //0x82c
    };
    VOID* PartitionObject;                                                  //0x830
    ULONGLONG SecurityDomain;                                               //0x838
    VOID* CoverageSamplerContext;                                           //0x840
}EPROCESS_WIN1803,*PEPROCESS_WIN1803;

//0x4 bytes (sizeof)
union _KPRCBFLAG
{
    volatile LONG PrcbFlags;                                                //0x0
    ULONG BamQosLevel : 2;                                                    //0x0
    ULONG PendingQosUpdate : 2;                                               //0x0
    ULONG CacheIsolationEnabled : 1;                                          //0x0
    ULONG PrcbFlagsReserved : 27;                                             //0x0
};

//0x10 bytes (sizeof)
struct _KDESCRIPTOR
{
    USHORT Pad[3];                                                          //0x0
    USHORT Limit;                                                           //0x6
    VOID* Base;                                                             //0x8
};


//0xf0 bytes (sizeof)
struct _KSPECIAL_REGISTERS
{
    ULONGLONG Cr0;                                                          //0x0
    ULONGLONG Cr2;                                                          //0x8
    ULONGLONG Cr3;                                                          //0x10
    ULONGLONG Cr4;                                                          //0x18
    ULONGLONG KernelDr0;                                                    //0x20
    ULONGLONG KernelDr1;                                                    //0x28
    ULONGLONG KernelDr2;                                                    //0x30
    ULONGLONG KernelDr3;                                                    //0x38
    ULONGLONG KernelDr6;                                                    //0x40
    ULONGLONG KernelDr7;                                                    //0x48
    struct _KDESCRIPTOR Gdtr;                                               //0x50
    struct _KDESCRIPTOR Idtr;                                               //0x60
    USHORT Tr;                                                              //0x70
    USHORT Ldtr;                                                            //0x72
    ULONG MxCsr;                                                            //0x74
    ULONGLONG DebugControl;                                                 //0x78
    ULONGLONG LastBranchToRip;                                              //0x80
    ULONGLONG LastBranchFromRip;                                            //0x88
    ULONGLONG LastExceptionToRip;                                           //0x90
    ULONGLONG LastExceptionFromRip;                                         //0x98
    ULONGLONG Cr8;                                                          //0xa0
    ULONGLONG MsrGsBase;                                                    //0xa8
    ULONGLONG MsrGsSwap;                                                    //0xb0
    ULONGLONG MsrStar;                                                      //0xb8
    ULONGLONG MsrLStar;                                                     //0xc0
    ULONGLONG MsrCStar;                                                     //0xc8
    ULONGLONG MsrSyscallMask;                                               //0xd0
    ULONGLONG Xcr0;                                                         //0xd8
    ULONGLONG MsrFsBase;                                                    //0xe0
    ULONGLONG SpecialPadding0;                                              //0xe8
};
//0x6 bytes (sizeof)
struct _PROC_IDLE_POLICY
{
    UCHAR PromotePercent;                                                   //0x0
    UCHAR DemotePercent;                                                    //0x1
    UCHAR PromotePercentBase;                                               //0x2
    UCHAR DemotePercentBase;                                                //0x3
    UCHAR AllowScaling;                                                     //0x4
    UCHAR ForceLightIdle;                                                   //0x5
};

//0x4 bytes (sizeof)
union _PPM_IDLE_SYNCHRONIZATION_STATE
{
    LONG AsLong;                                                            //0x0
    LONG RefCount : 24;                                                       //0x0
    ULONG State : 8;                                                          //0x0
};


//0x20 bytes (sizeof)
struct _PPM_FFH_THROTTLE_STATE_INFO
{
    UCHAR EnableLogging;                                                    //0x0
    ULONG MismatchCount;                                                    //0x4
    UCHAR Initialized;                                                      //0x8
    ULONGLONG LastValue;                                                    //0x10
    union _LARGE_INTEGER LastLogTickCount;                                  //0x18
};
//0x90 bytes (sizeof)
struct _PROC_FEEDBACK
{
    ULONGLONG Lock;                                                         //0x0
    ULONGLONG CyclesLast;                                                   //0x8
    ULONGLONG CyclesActive;                                                 //0x10
    struct _PROC_FEEDBACK_COUNTER* Counters[2];                             //0x18
    ULONGLONG LastUpdateTime;                                               //0x28
    ULONGLONG UnscaledTime;                                                 //0x30
    volatile LONGLONG UnaccountedTime;                                      //0x38
    ULONGLONG ScaledTime[2];                                                //0x40
    ULONGLONG UnaccountedKernelTime;                                        //0x50
    ULONGLONG PerformanceScaledKernelTime;                                  //0x58
    ULONG UserTimeLast;                                                     //0x60
    ULONG KernelTimeLast;                                                   //0x64
    ULONGLONG IdleGenerationNumberLast;                                     //0x68
    ULONGLONG HvActiveTimeLast;                                             //0x70
    ULONGLONG StallCyclesLast;                                              //0x78
    ULONGLONG StallTime;                                                    //0x80
    UCHAR KernelTimesIndex;                                                 //0x88
    UCHAR CounterDiscardsIdleTime;                                          //0x89
};

//0x10 bytes (sizeof)
struct _PROC_IDLE_SNAP
{
    ULONGLONG Time;                                                         //0x0
    ULONGLONG Idle;                                                         //0x8
};
//0x200 bytes (sizeof)
struct _PROCESSOR_POWER_STATE
{
    struct _PPM_IDLE_STATES* IdleStates;                                    //0x0
    struct _PROC_IDLE_ACCOUNTING* IdleAccounting;                           //0x8
    ULONGLONG IdleTimeLast;                                                 //0x10
    ULONGLONG IdleTimeTotal;                                                //0x18
    volatile ULONGLONG IdleTimeEntry;                                       //0x20
    ULONGLONG IdleTimeExpiration;                                           //0x28
    UCHAR NonInterruptibleTransition;                                       //0x30
    UCHAR PepWokenTransition;                                               //0x31
    UCHAR EfficiencyClass;                                                  //0x32
    UCHAR SchedulingClass;                                                  //0x33
    ULONG TargetIdleState;                                                  //0x34
    struct _PROC_IDLE_POLICY IdlePolicy;                                    //0x38
    union _PPM_IDLE_SYNCHRONIZATION_STATE Synchronization;          //0x40
    struct _PROC_FEEDBACK PerfFeedback;                                     //0x48
    enum _PROC_HYPERVISOR_STATE Hypervisor;                                 //0xd8
    ULONG LastSysTime;                                                      //0xdc
    ULONGLONG WmiDispatchPtr;                                               //0xe0
    LONG WmiInterfaceEnabled;                                               //0xe8
    struct _PPM_FFH_THROTTLE_STATE_INFO FFHThrottleStateInfo;               //0xf0
    struct _KDPC PerfActionDpc;                                             //0x110
    volatile LONG PerfActionMask;                                           //0x150
    struct _PROC_IDLE_SNAP HvIdleCheck;                                     //0x158
    struct _PROC_PERF_CHECK* PerfCheck;                                     //0x168
    struct _PROC_PERF_DOMAIN* Domain;                                       //0x170
    struct _PROC_PERF_CONSTRAINT* PerfConstraint;                           //0x178
    struct _PPM_CONCURRENCY_ACCOUNTING* Concurrency;                        //0x180
    struct _PPM_CONCURRENCY_ACCOUNTING* ClassConcurrency;                   //0x188
    struct _PROC_PERF_LOAD* Load;                                           //0x190
    struct _PROC_PERF_HISTORY* PerfHistory;                                 //0x198
    UCHAR GuaranteedPerformancePercent;                                     //0x1a0
    UCHAR HvTargetState;                                                    //0x1a1
    UCHAR Parked;                                                           //0x1a2
    UCHAR LongPriorQosPeriod;                                               //0x1a3
    ULONG LatestPerformancePercent;                                         //0x1a4
    ULONG AveragePerformancePercent;                                        //0x1a8
    ULONG LatestAffinitizedPercent;                                         //0x1ac
    ULONG RelativePerformance;                                              //0x1b0
    ULONG Utility;                                                          //0x1b4
    ULONG AffinitizedUtility;                                               //0x1b8
    union
    {
        ULONGLONG SnapTimeLast;                                             //0x1c0
        ULONGLONG EnergyConsumed;                                           //0x1c0
    };
    ULONGLONG ActiveTime;                                                   //0x1c8
    ULONGLONG TotalTime;                                                    //0x1d0
    struct _POP_FX_DEVICE* FxDevice;                                        //0x1d8
    ULONGLONG LastQosTranstionTsc;                                          //0x1e0
    ULONGLONG QosTransitionHysteresis;                                      //0x1e8
    enum _KHETERO_CPU_QOS RequestedQosClass;                                //0x1f0
    enum _KHETERO_CPU_QOS ResolvedQosClass;                                 //0x1f4
    ULONG QosEquivalencyMask;                                               //0x1f8
};
//0x5c0 bytes (sizeof)
struct _KPROCESSOR_STATE
{
    struct _KSPECIAL_REGISTERS SpecialRegisters;                            //0x0
    struct _CONTEXT ContextFrame;                                           //0xf0
};

//0x20 bytes (sizeof)
struct _KTIMER_TABLE_ENTRY
{
    ULONGLONG Lock;                                                         //0x0
    struct _LIST_ENTRY Entry;                                               //0x8
    union _ULARGE_INTEGER Time;                                             //0x18
};

//0x2200 bytes (sizeof)
struct _KTIMER_TABLE
{
    struct _KTIMER* TimerExpiry[64];                                        //0x0
    struct _KTIMER_TABLE_ENTRY TimerEntries[256];                           //0x200
};
//0x10 bytes (sizeof)
struct _PP_LOOKASIDE_LIST
{
    struct _GENERAL_LOOKASIDE* P;                                           //0x0
    struct _GENERAL_LOOKASIDE* L;                                           //0x8
};

//0x10 bytes (sizeof)
struct _KDPC_LIST
{
    struct _SINGLE_LIST_ENTRY ListHead;                                     //0x0
    struct _SINGLE_LIST_ENTRY* LastEntry;                                   //0x8
};

//0x28 bytes (sizeof)
struct _KDPC_DATA
{
    struct _KDPC_LIST DpcList;                                              //0x0
    ULONGLONG DpcLock;                                                      //0x10
    volatile LONG DpcQueueDepth;                                            //0x18
    ULONG DpcCount;                                                         //0x1c
    struct _KDPC* volatile ActiveDpc;                                       //0x20
};

//0xb8 bytes (sizeof)
struct _SYNCH_COUNTERS
{
    ULONG SpinLockAcquireCount;                                             //0x0
    ULONG SpinLockContentionCount;                                          //0x4
    ULONG SpinLockSpinCount;                                                //0x8
    ULONG IpiSendRequestBroadcastCount;                                     //0xc
    ULONG IpiSendRequestRoutineCount;                                       //0x10
    ULONG IpiSendSoftwareInterruptCount;                                    //0x14
    ULONG ExInitializeResourceCount;                                        //0x18
    ULONG ExReInitializeResourceCount;                                      //0x1c
    ULONG ExDeleteResourceCount;                                            //0x20
    ULONG ExecutiveResourceAcquiresCount;                                   //0x24
    ULONG ExecutiveResourceContentionsCount;                                //0x28
    ULONG ExecutiveResourceReleaseExclusiveCount;                           //0x2c
    ULONG ExecutiveResourceReleaseSharedCount;                              //0x30
    ULONG ExecutiveResourceConvertsCount;                                   //0x34
    ULONG ExAcqResExclusiveAttempts;                                        //0x38
    ULONG ExAcqResExclusiveAcquiresExclusive;                               //0x3c
    ULONG ExAcqResExclusiveAcquiresExclusiveRecursive;                      //0x40
    ULONG ExAcqResExclusiveWaits;                                           //0x44
    ULONG ExAcqResExclusiveNotAcquires;                                     //0x48
    ULONG ExAcqResSharedAttempts;                                           //0x4c
    ULONG ExAcqResSharedAcquiresExclusive;                                  //0x50
    ULONG ExAcqResSharedAcquiresShared;                                     //0x54
    ULONG ExAcqResSharedAcquiresSharedRecursive;                            //0x58
    ULONG ExAcqResSharedWaits;                                              //0x5c
    ULONG ExAcqResSharedNotAcquires;                                        //0x60
    ULONG ExAcqResSharedStarveExclusiveAttempts;                            //0x64
    ULONG ExAcqResSharedStarveExclusiveAcquiresExclusive;                   //0x68
    ULONG ExAcqResSharedStarveExclusiveAcquiresShared;                      //0x6c
    ULONG ExAcqResSharedStarveExclusiveAcquiresSharedRecursive;             //0x70
    ULONG ExAcqResSharedStarveExclusiveWaits;                               //0x74
    ULONG ExAcqResSharedStarveExclusiveNotAcquires;                         //0x78
    ULONG ExAcqResSharedWaitForExclusiveAttempts;                           //0x7c
    ULONG ExAcqResSharedWaitForExclusiveAcquiresExclusive;                  //0x80
    ULONG ExAcqResSharedWaitForExclusiveAcquiresShared;                     //0x84
    ULONG ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive;            //0x88
    ULONG ExAcqResSharedWaitForExclusiveWaits;                              //0x8c
    ULONG ExAcqResSharedWaitForExclusiveNotAcquires;                        //0x90
    ULONG ExSetResOwnerPointerExclusive;                                    //0x94
    ULONG ExSetResOwnerPointerSharedNew;                                    //0x98
    ULONG ExSetResOwnerPointerSharedOld;                                    //0x9c
    ULONG ExTryToAcqExclusiveAttempts;                                      //0xa0
    ULONG ExTryToAcqExclusiveAcquires;                                      //0xa4
    ULONG ExBoostExclusiveOwner;                                            //0xa8
    ULONG ExBoostSharedOwners;                                              //0xac
    ULONG ExEtwSynchTrackingNotificationsCount;                             //0xb0
    ULONG ExEtwSynchTrackingNotificationsAccountedCount;                    //0xb4
};
//0x10 bytes (sizeof)
struct _FILESYSTEM_DISK_COUNTERS
{
    ULONGLONG FsBytesRead;                                                  //0x0
    ULONGLONG FsBytesWritten;                                               //0x8
};

//0x150 bytes (sizeof)
struct _KENTROPY_TIMING_STATE
{
    ULONG EntropyCount;                                                     //0x0
    ULONG Buffer[64];                                                       //0x4
    struct _KDPC Dpc;                                                       //0x108
    ULONG LastDeliveredBuffer;                                              //0x148
};
//0x54 bytes (sizeof)
struct _IOP_IRP_STACK_PROFILER
{
    ULONG Profile[20];                                                      //0x0
    ULONG TotalIrps;                                                        //0x50
};
//0x10 bytes (sizeof)
struct _KTIMER_EXPIRATION_TRACE
{
    ULONGLONG InterruptTime;                                                //0x0
    union _LARGE_INTEGER PerformanceCounter;                                //0x8
};
//0x20 bytes (sizeof)
struct _KREQUEST_PACKET
{
    VOID* CurrentPacket[3];                                                 //0x0
    VOID(*WorkerRoutine)(VOID* arg1, VOID* arg2, VOID* arg3, VOID* arg4);  //0x18
};
//0x40 bytes (sizeof)
struct _REQUEST_MAILBOX
{
    struct _REQUEST_MAILBOX* Next;                                          //0x0
    ULONGLONG RequestSummary;                                               //0x8
    struct _KREQUEST_PACKET RequestPacket;                                  //0x10
    volatile LONG* NodeTargetCountAddr;                                     //0x30
    volatile LONG NodeTargetCount;                                          //0x38
};
//0x270 bytes (sizeof)
struct _KSHARED_READY_QUEUE
{
    ULONGLONG Lock;                                                         //0x0
    ULONG ReadySummary;                                                     //0x8
    struct _LIST_ENTRY ReadyListHead[32];                                   //0x10
    CHAR RunningSummary[64];                                                //0x210
    UCHAR Span;                                                             //0x250
    UCHAR LowProcIndex;                                                     //0x251
    UCHAR QueueIndex;                                                       //0x252
    UCHAR ProcCount;                                                        //0x253
    UCHAR ScanOwner;                                                        //0x254
    UCHAR Spare[3];                                                         //0x255
    ULONGLONG Affinity;                                                     //0x258
    ULONG ReadyThreadCount;                                                 //0x260
    ULONGLONG ReadyQueueExpectedRunTime;                                    //0x268
};

//0x10 bytes (sizeof)
struct _KSECURE_FAULT_INFORMATION
{
    ULONGLONG FaultCode;                                                    //0x0
    ULONGLONG FaultVa;                                                      //0x8
};
// 0x7ec0 bytes(sizeof)
struct _KPRCB
{
    ULONG MxCsr;                                                            //0x0
    UCHAR LegacyNumber;                                                     //0x4
    UCHAR ReservedMustBeZero;                                               //0x5
    UCHAR InterruptRequest;                                                 //0x6
    UCHAR IdleHalt;                                                         //0x7
    struct _KTHREAD* CurrentThread;                                         //0x8
    struct _KTHREAD* NextThread;                                            //0x10
    struct _KTHREAD* IdleThread;                                            //0x18
    UCHAR NestingLevel;                                                     //0x20
    UCHAR ClockOwner;                                                       //0x21
    union
    {
        UCHAR PendingTickFlags;                                             //0x22
        struct
        {
            UCHAR PendingTick : 1;                                            //0x22
            UCHAR PendingBackupTick : 1;                                      //0x22
        };
    };
    UCHAR IdleState;                                                        //0x23
    ULONG Number;                                                           //0x24
    ULONGLONG RspBase;                                                      //0x28
    ULONGLONG PrcbLock;                                                     //0x30
    CHAR* PriorityState;                                                    //0x38
    CHAR CpuType;                                                           //0x40
    CHAR CpuID;                                                             //0x41
    union
    {
        USHORT CpuStep;                                                     //0x42
        struct
        {
            UCHAR CpuStepping;                                              //0x42
            UCHAR CpuModel;                                                 //0x43
        };
    };
    ULONG MHz;                                                              //0x44
    ULONGLONG HalReserved[8];                                               //0x48
    USHORT MinorVersion;                                                    //0x88
    USHORT MajorVersion;                                                    //0x8a
    UCHAR BuildType;                                                        //0x8c
    UCHAR CpuVendor;                                                        //0x8d
    UCHAR CoresPerPhysicalProcessor;                                        //0x8e
    UCHAR LogicalProcessorsPerCore;                                         //0x8f
    ULONGLONG PrcbPad04[6];                                                 //0x90
    struct _KNODE* ParentNode;                                              //0xc0
    ULONGLONG GroupSetMember;                                               //0xc8
    UCHAR Group;                                                            //0xd0
    UCHAR GroupIndex;                                                       //0xd1
    UCHAR PrcbPad05[2];                                                     //0xd2
    ULONG InitialApicId;                                                    //0xd4
    ULONG ScbOffset;                                                        //0xd8
    ULONG ApicMask;                                                         //0xdc
    VOID* AcpiReserved;                                                     //0xe0
    ULONG CFlushSize;                                                       //0xe8
    union _KPRCBFLAG PrcbFlags;                                             //0xec
    union
    {
        struct
        {
            ULONGLONG TrappedSecurityDomain;                                //0xf0
            union
            {
                USHORT BpbState;                                            //0xf8
                struct
                {
                    USHORT BpbIbrsPresent : 1;                                //0xf8
                    USHORT BpbStibpPresent : 1;                               //0xf8
                    USHORT BpbSmepPresent : 1;                                //0xf8
                    USHORT BpbSimulateSpecCtrl : 1;                           //0xf8
                    USHORT BpbSimulateIbpb : 1;                               //0xf8
                    USHORT BpbIbpbPresent : 1;                                //0xf8
                    USHORT BpbCpuIdle : 1;                                    //0xf8
                    USHORT BpbClearSpecCtrlOnIdle : 1;                        //0xf8
                    USHORT BpbHTDisabled : 1;                                 //0xf8
                    USHORT BpbUserToUserOnly : 1;                             //0xf8
                    USHORT BpbReserved : 6;                                   //0xf8
                };
            };
            UCHAR BpbSpecCtrlValue;                                         //0xfa
            UCHAR BpbCtxSwapSetValue;                                       //0xfb
            UCHAR BpbPad[4];                                                //0xfc
        };
        ULONGLONG PrcbPad11[2];                                             //0xf0
    };
    struct _KPROCESSOR_STATE ProcessorState;                                //0x100
    struct _XSAVE_AREA_HEADER* ExtendedSupervisorState;                     //0x6c0
    ULONGLONG PrcbPad12[5];                                                 //0x6c8
    struct _KSPIN_LOCK_QUEUE LockQueue[17];                                 //0x6f0
    struct _PP_LOOKASIDE_LIST PPLookasideList[16];                          //0x800
    struct _GENERAL_LOOKASIDE_POOL PPNxPagedLookasideList[32];              //0x900
    struct _GENERAL_LOOKASIDE_POOL PPNPagedLookasideList[32];               //0x1500
    struct _GENERAL_LOOKASIDE_POOL PPPagedLookasideList[32];                //0x2100
    ULONGLONG PrcbPad20;                                                    //0x2d00
    struct _SINGLE_LIST_ENTRY DeferredReadyListHead;                        //0x2d08
    volatile LONG MmPageFaultCount;                                         //0x2d10
    volatile LONG MmCopyOnWriteCount;                                       //0x2d14
    volatile LONG MmTransitionCount;                                        //0x2d18
    volatile LONG MmDemandZeroCount;                                        //0x2d1c
    volatile LONG MmPageReadCount;                                          //0x2d20
    volatile LONG MmPageReadIoCount;                                        //0x2d24
    volatile LONG MmDirtyPagesWriteCount;                                   //0x2d28
    volatile LONG MmDirtyWriteIoCount;                                      //0x2d2c
    volatile LONG MmMappedPagesWriteCount;                                  //0x2d30
    volatile LONG MmMappedWriteIoCount;                                     //0x2d34
    ULONG KeSystemCalls;                                                    //0x2d38
    ULONG KeContextSwitches;                                                //0x2d3c
    ULONG PrcbPad40;                                                        //0x2d40
    ULONG CcFastReadNoWait;                                                 //0x2d44
    ULONG CcFastReadWait;                                                   //0x2d48
    ULONG CcFastReadNotPossible;                                            //0x2d4c
    ULONG CcCopyReadNoWait;                                                 //0x2d50
    ULONG CcCopyReadWait;                                                   //0x2d54
    ULONG CcCopyReadNoWaitMiss;                                             //0x2d58
    volatile LONG IoReadOperationCount;                                     //0x2d5c
    volatile LONG IoWriteOperationCount;                                    //0x2d60
    volatile LONG IoOtherOperationCount;                                    //0x2d64
    union _LARGE_INTEGER IoReadTransferCount;                               //0x2d68
    union _LARGE_INTEGER IoWriteTransferCount;                              //0x2d70
    union _LARGE_INTEGER IoOtherTransferCount;                              //0x2d78
    volatile LONG PacketBarrier;                                            //0x2d80
    volatile LONG TargetCount;                                              //0x2d84
    volatile ULONG IpiFrozen;                                               //0x2d88
    ULONG PrcbPad30;                                                        //0x2d8c
    VOID* IsrDpcStats;                                                      //0x2d90
    ULONG DeviceInterrupts;                                                 //0x2d98
    LONG LookasideIrpFloat;                                                 //0x2d9c
    ULONG InterruptLastCount;                                               //0x2da0
    ULONG InterruptRate;                                                    //0x2da4
    ULONGLONG LastNonHrTimerExpiration;                                     //0x2da8
    ULONGLONG PrcbPad35[2];                                                 //0x2db0
    union _SLIST_HEADER InterruptObjectPool;                                //0x2dc0
    ULONGLONG PrcbPad41[6];                                                 //0x2dd0
    struct _KDPC_DATA DpcData[2];                                           //0x2e00
    VOID* DpcStack;                                                         //0x2e50
    LONG MaximumDpcQueueDepth;                                              //0x2e58
    ULONG DpcRequestRate;                                                   //0x2e5c
    ULONG MinimumDpcRate;                                                   //0x2e60
    ULONG DpcLastCount;                                                     //0x2e64
    UCHAR ThreadDpcEnable;                                                  //0x2e68
    volatile UCHAR QuantumEnd;                                              //0x2e69
    volatile UCHAR DpcRoutineActive;                                        //0x2e6a
    volatile UCHAR IdleSchedule;                                            //0x2e6b
    union
    {
        volatile LONG DpcRequestSummary;                                    //0x2e6c
        SHORT DpcRequestSlot[2];                                            //0x2e6c
        struct
        {
            SHORT NormalDpcState;                                           //0x2e6c
            SHORT ThreadDpcState;                                           //0x2e6e
        };
        struct
        {
            ULONG DpcNormalProcessingActive : 1;                              //0x2e6c
            ULONG DpcNormalProcessingRequested : 1;                           //0x2e6c
            ULONG DpcNormalThreadSignal : 1;                                  //0x2e6c
            ULONG DpcNormalTimerExpiration : 1;                               //0x2e6c
            ULONG DpcNormalDpcPresent : 1;                                    //0x2e6c
            ULONG DpcNormalLocalInterrupt : 1;                                //0x2e6c
            ULONG DpcNormalSpare : 10;                                        //0x2e6c
            ULONG DpcThreadActive : 1;                                        //0x2e6c
            ULONG DpcThreadRequested : 1;                                     //0x2e6c
            ULONG DpcThreadSpare : 14;                                        //0x2e6c
        };
    };
    ULONG LastTimerHand;                                                    //0x2e70
    ULONG LastTick;                                                         //0x2e74
    ULONG ClockInterrupts;                                                  //0x2e78
    ULONG ReadyScanTick;                                                    //0x2e7c
    VOID* InterruptObject[256];                                             //0x2e80
    struct _KTIMER_TABLE TimerTable;                                        //0x3680
    struct _KGATE DpcGate;                                                  //0x5880
    VOID* PrcbPad52;                                                        //0x5898
    struct _KDPC CallDpc;                                                   //0x58a0
    LONG ClockKeepAlive;                                                    //0x58e0
    UCHAR PrcbPad60[2];                                                     //0x58e4
    USHORT NmiActive;                                                       //0x58e6
    LONG DpcWatchdogPeriod;                                                 //0x58e8
    LONG DpcWatchdogCount;                                                  //0x58ec
    volatile LONG KeSpinLockOrdering;                                       //0x58f0
    ULONG DpcWatchdogProfileCumulativeDpcThreshold;                         //0x58f4
    VOID* CachedPtes;                                                       //0x58f8
    struct _LIST_ENTRY WaitListHead;                                        //0x5900
    ULONGLONG WaitLock;                                                     //0x5910
    ULONG ReadySummary;                                                     //0x5918
    LONG AffinitizedSelectionMask;                                          //0x591c
    ULONG QueueIndex;                                                       //0x5920
    ULONG PrcbPad75[3];                                                     //0x5924
    struct _KDPC TimerExpirationDpc;                                        //0x5930
    struct _RTL_RB_TREE ScbQueue;                                           //0x5970
    struct _LIST_ENTRY DispatcherReadyListHead[32];                         //0x5980
    ULONG InterruptCount;                                                   //0x5b80
    ULONG KernelTime;                                                       //0x5b84
    ULONG UserTime;                                                         //0x5b88
    ULONG DpcTime;                                                          //0x5b8c
    ULONG InterruptTime;                                                    //0x5b90
    ULONG AdjustDpcThreshold;                                               //0x5b94
    UCHAR DebuggerSavedIRQL;                                                //0x5b98
    UCHAR GroupSchedulingOverQuota;                                         //0x5b99
    volatile UCHAR DeepSleep;                                               //0x5b9a
    UCHAR PrcbPad80;                                                        //0x5b9b
    ULONG DpcTimeCount;                                                     //0x5b9c
    ULONG DpcTimeLimit;                                                     //0x5ba0
    ULONG PeriodicCount;                                                    //0x5ba4
    ULONG PeriodicBias;                                                     //0x5ba8
    ULONG AvailableTime;                                                    //0x5bac
    ULONG KeExceptionDispatchCount;                                         //0x5bb0
    ULONG ReadyThreadCount;                                                 //0x5bb4
    ULONGLONG ReadyQueueExpectedRunTime;                                    //0x5bb8
    ULONGLONG StartCycles;                                                  //0x5bc0
    ULONGLONG TaggedCyclesStart;                                            //0x5bc8
    ULONGLONG TaggedCycles[2];                                              //0x5bd0
    ULONGLONG GenerationTarget;                                             //0x5be0
    ULONGLONG AffinitizedCycles;                                            //0x5be8
    ULONGLONG ImportantCycles;                                              //0x5bf0
    ULONGLONG UnimportantCycles;                                            //0x5bf8
    ULONG DpcWatchdogProfileSingleDpcThreshold;                             //0x5c00
    volatile LONG MmSpinLockOrdering;                                       //0x5c04
    VOID* volatile CachedStack;                                             //0x5c08
    ULONG PageColor;                                                        //0x5c10
    ULONG NodeColor;                                                        //0x5c14
    ULONG NodeShiftedColor;                                                 //0x5c18
    ULONG SecondaryColorMask;                                               //0x5c1c
    UCHAR PrcbPad81[7];                                                     //0x5c20
    UCHAR TbFlushListActive;                                                //0x5c27
    ULONGLONG PrcbPad82[2];                                                 //0x5c28
    ULONGLONG CycleTime;                                                    //0x5c38
    ULONGLONG Cycles[4][2];                                                 //0x5c40
    ULONG CcFastMdlReadNoWait;                                              //0x5c80
    ULONG CcFastMdlReadWait;                                                //0x5c84
    ULONG CcFastMdlReadNotPossible;                                         //0x5c88
    ULONG CcMapDataNoWait;                                                  //0x5c8c
    ULONG CcMapDataWait;                                                    //0x5c90
    ULONG CcPinMappedDataCount;                                             //0x5c94
    ULONG CcPinReadNoWait;                                                  //0x5c98
    ULONG CcPinReadWait;                                                    //0x5c9c
    ULONG CcMdlReadNoWait;                                                  //0x5ca0
    ULONG CcMdlReadWait;                                                    //0x5ca4
    ULONG CcLazyWriteHotSpots;                                              //0x5ca8
    ULONG CcLazyWriteIos;                                                   //0x5cac
    ULONG CcLazyWritePages;                                                 //0x5cb0
    ULONG CcDataFlushes;                                                    //0x5cb4
    ULONG CcDataPages;                                                      //0x5cb8
    ULONG CcLostDelayedWrites;                                              //0x5cbc
    ULONG CcFastReadResourceMiss;                                           //0x5cc0
    ULONG CcCopyReadWaitMiss;                                               //0x5cc4
    ULONG CcFastMdlReadResourceMiss;                                        //0x5cc8
    ULONG CcMapDataNoWaitMiss;                                              //0x5ccc
    ULONG CcMapDataWaitMiss;                                                //0x5cd0
    ULONG CcPinReadNoWaitMiss;                                              //0x5cd4
    ULONG CcPinReadWaitMiss;                                                //0x5cd8
    ULONG CcMdlReadNoWaitMiss;                                              //0x5cdc
    ULONG CcMdlReadWaitMiss;                                                //0x5ce0
    ULONG CcReadAheadIos;                                                   //0x5ce4
    volatile LONG MmCacheTransitionCount;                                   //0x5ce8
    volatile LONG MmCacheReadCount;                                         //0x5cec
    volatile LONG MmCacheIoCount;                                           //0x5cf0
    ULONG PrcbPad91;                                                        //0x5cf4
    VOID* MmFlushList;                                                      //0x5cf8
    struct _PROCESSOR_POWER_STATE PowerState;                               //0x5d00
    VOID* HyperPte;                                                         //0x5f00
    struct _LIST_ENTRY ScbList;                                             //0x5f08
    struct _KDPC ForceIdleDpc;                                              //0x5f18
    struct _KDPC DpcWatchdogDpc;                                            //0x5f58
    struct _KTIMER DpcWatchdogTimer;                                        //0x5f98
    struct _CACHE_DESCRIPTOR Cache[5];                                      //0x5fd8
    ULONG CacheCount;                                                       //0x6014
    volatile ULONG CachedCommit;                                            //0x6018
    volatile ULONG CachedResidentAvailable;                                 //0x601c
    VOID* WheaInfo;                                                         //0x6020
    VOID* EtwSupport;                                                       //0x6028
    VOID* ExSaPageArray;                                                    //0x6030
    ULONG KeAlignmentFixupCount;                                            //0x6038
    ULONG PrcbPad95;                                                        //0x603c
    union _SLIST_HEADER HypercallPageList;                                  //0x6040
    ULONGLONG* StatisticsPage;                                              //0x6050
    ULONGLONG PrcbPad85[5];                                                 //0x6058
    VOID* HypercallCachedPages;                                             //0x6080
    VOID* VirtualApicAssist;                                                //0x6088
    struct _KAFFINITY_EX PackageProcessorSet;                               //0x6090
    ULONGLONG PrcbPad86;                                                    //0x6138
    ULONGLONG SharedReadyQueueMask;                                         //0x6140
    struct _KSHARED_READY_QUEUE* SharedReadyQueue;                          //0x6148
    ULONG SharedQueueScanOwner;                                             //0x6150
    ULONG ScanSiblingIndex;                                                 //0x6154
    ULONGLONG CoreProcessorSet;                                             //0x6158
    ULONGLONG ScanSiblingMask;                                              //0x6160
    ULONGLONG LLCMask;                                                      //0x6168
    ULONGLONG CacheProcessorMask[5];                                        //0x6170
    struct _PROCESSOR_PROFILE_CONTROL_AREA* ProcessorProfileControlArea;    //0x6198
    VOID* ProfileEventIndexAddress;                                         //0x61a0
    VOID** DpcWatchdogProfile;                                              //0x61a8
    VOID** DpcWatchdogProfileCurrentEmptyCapture;                           //0x61b0
    VOID* SchedulerAssist;                                                  //0x61b8
    struct _SYNCH_COUNTERS SynchCounters;                                   //0x61c0
    ULONGLONG PrcbPad94;                                                    //0x6278
    struct _FILESYSTEM_DISK_COUNTERS FsCounters;                            //0x6280
    UCHAR VendorString[13];                                                 //0x6290
    UCHAR PrcbPad100[3];                                                    //0x629d
    ULONGLONG FeatureBits;                                                  //0x62a0
    union _LARGE_INTEGER UpdateSignature;                                   //0x62a8
    ULONGLONG PteBitCache;                                                  //0x62b0
    ULONG PteBitOffset;                                                     //0x62b8
    ULONG PrcbPad105;                                                       //0x62bc
    struct _CONTEXT* Context;                                               //0x62c0
    ULONG ContextFlagsInit;                                                 //0x62c8
    ULONG PrcbPad115;                                                       //0x62cc
    struct _XSAVE_AREA* ExtendedState;                                      //0x62d0
    VOID* IsrStack;                                                         //0x62d8
    struct _KENTROPY_TIMING_STATE EntropyTimingState;                       //0x62e0
    ULONGLONG PrcbPad110;                                                   //0x6430
    ULONGLONG PrcbPad111[7];                                                //0x6438
    struct _SINGLE_LIST_ENTRY AbSelfIoBoostsList;                           //0x6470
    struct _SINGLE_LIST_ENTRY AbPropagateBoostsList;                        //0x6478
    struct _KDPC AbDpc;                                                     //0x6480
    struct _IOP_IRP_STACK_PROFILER IoIrpStackProfilerCurrent;               //0x64c0
    struct _IOP_IRP_STACK_PROFILER IoIrpStackProfilerPrevious;              //0x6514
    struct _KSECURE_FAULT_INFORMATION SecureFault;                          //0x6568
    ULONGLONG PrcbPad120;                                                   //0x6578
    struct _KSHARED_READY_QUEUE LocalSharedReadyQueue;                      //0x6580
    ULONGLONG PrcbPad125[2];                                                //0x67f0
    ULONG TimerExpirationTraceCount;                                        //0x6800
    ULONG PrcbPad127;                                                       //0x6804
    struct _KTIMER_EXPIRATION_TRACE TimerExpirationTrace[16];               //0x6808
    ULONGLONG PrcbPad128[7];                                                //0x6908
    struct _REQUEST_MAILBOX* Mailbox;                                       //0x6940
    ULONGLONG PrcbPad130[7];                                                //0x6948
    struct _KLOCK_QUEUE_HANDLE SelfmapLockHandle[4];                        //0x6980
    UCHAR PrcbPad135[1184];                                                 //0x69e0
    ULONGLONG KernelDirectoryTableBase;                                     //0x6e80
    ULONGLONG RspBaseShadow;                                                //0x6e88
    ULONGLONG UserRspShadow;                                                //0x6e90
    ULONG ShadowFlags;                                                      //0x6e98
    ULONG PrcbPad139;                                                       //0x6e9c
    ULONGLONG PrcbPad140[508];                                              //0x6ea0
    struct _REQUEST_MAILBOX RequestMailbox[1];                              //0x7e80
};
//0x8040 bytes (sizeof)
typedef struct _KPCR_WIN1803
{
    union
    {
        struct _NT_TIB NtTib;                                               //0x0
        struct
        {
            union _KGDTENTRY64* GdtBase;                                    //0x0
            struct _KTSS64* TssBase;                                        //0x8
            ULONGLONG UserRsp;                                              //0x10
            struct _KPCR* Self;                                             //0x18
            struct _KPRCB* CurrentPrcb;                                     //0x20
            struct _KSPIN_LOCK_QUEUE* LockArray;                            //0x28
            VOID* Used_Self;                                                //0x30
        };
    };
    union _KIDTENTRY64* IdtBase;                                            //0x38
    ULONGLONG Unused[2];                                                    //0x40
    UCHAR Irql;                                                             //0x50
    UCHAR SecondLevelCacheAssociativity;                                    //0x51
    UCHAR ObsoleteNumber;                                                   //0x52
    UCHAR Fill0;                                                            //0x53
    ULONG Unused0[3];                                                       //0x54
    USHORT MajorVersion;                                                    //0x60
    USHORT MinorVersion;                                                    //0x62
    ULONG StallScaleFactor;                                                 //0x64
    VOID* Unused1[3];                                                       //0x68
    ULONG KernelReserved[15];                                               //0x80
    ULONG SecondLevelCacheSize;                                             //0xbc
    ULONG HalReserved[16];                                                  //0xc0
    ULONG Unused2;                                                          //0x100
    VOID* KdVersionBlock;                                                   //0x108
    VOID* Unused3;                                                          //0x110
    ULONG PcrAlign1[24];                                                    //0x118
    struct _KPRCB Prcb;                                                     //0x180
}KPCR_WIN1803,*PKPCR_WIN1803;


typedef struct _SYSTEM_MODULE_ENTRY
{
    HANDLE Section;
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    UCHAR FullPathName[256];
} SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY;



typedef struct _SYSTEM_MODULE_INFORMATION
{
    ULONG Count;
    SYSTEM_MODULE_ENTRY Module[0];
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
#endif 